CVE-2026-87824

zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in the Zstd.trainFromBufferDirect dictionary-training method, producing an out-of-bounds read (CWE-125) in the native code. An attacker who can influence the sample data or the per-sample length array passed to this API can supply oversized sample lengths, causing the JNI implementation to walk past the end of the allocated buffer. The primary impact is availability: the out-of-bounds memory access can terminate the JVM, with no confidentiality or integrity impact indicated in the CVSS 4.0 score (VA:H, VC:N/VI:N). Any JVM application that invokes Zstd.trainFromBufferDirect on attacker-controlled or untrusted input is affected, which is a subset of the many projects that bundle zstd-jni for Zstandard compression. No public proof-of-concept, listing in CISA KEV, or known in-the-wild exploitation has been reported.

What to do: Upgrade zstd-jni to 1.5.7-14 or later wherever it is present. Audit dependency trees (e.g., mvn dependency:tree, gradle dependencies) for zstd-jni and identify whether application code calls Zstd.trainFromBufferDirect with external input; as an interim mitigation, clamp or validate sample lengths against the buffer size before training, or avoid running dictionary training on untrusted data. No workarounds or in-the-wild exploitation are documented, so patching can follow normal maintenance cycles unless the training API handles untrusted input.