CVE-2026-87823

zstd-jni, the Java JNI binding for the Zstandard compression library, relies on 32-bit signed bounds checks in three direct-ByteBuffer frame-size native methods, which allows negative or overflowing offsets to bypass validation (CWE-190, integer overflow/wraparound). An attacker who can control the offset passed to these methods — for example a value near Integer.MIN_VALUE — triggers an out-of-bounds native memory read that can hit unmapped memory and terminate the JVM, or cause frame-size data to be read from unintended memory locations. The practical impact is primarily availability (JVM process crash) with limited disclosure of memory contents, consistent with the CVSS 4.0 score of 8.8 (low confidentiality, high availability impact, network vector, no privileges). Any application embedding zstd-jni before 1.5.7-14 that passes attacker-controlled offsets into the affected direct-ByteBuffer native methods is affected, while deployments that only use higher-level compress/decompress APIs with internally managed buffers are unlikely to be reachable. No public proof-of-concept, in-the-wild exploitation, or KEV listing is known as of this analysis.

What to do: Upgrade to zstd-jni 1.5.7-14 or later and rebuild/redeploy any application, container, or distribution that bundles the library. Until patched, audit call sites that feed application- or user-controlled offsets (e.g., ByteBuffer positions near Integer.MIN_VALUE) into the direct-ByteBuffer frame-size native methods and validate/clamp offsets before the native call. Check dependency trees (mvn dependency:tree, gradle dependencies) for vulnerable zstd-jni versions, including transitive pulls via Kafka- or Spark-class components.