CVE-2026-87825

zstd-jni before 1.5.7-14, the Java JNI binding for the Zstandard (zstd) compression library, contains a use-after-free (CWE-416): streams and compression contexts hold a dictionary's shared lock only during the load call, so the dictionary can be freed while still in use. An attacker, or simply buggy application code, can close a dictionary after it has been associated with a stream or context, causing later read or write operations to access freed native memory. The result is silent corruption of compressed or decompressed data or outright JVM crashes, with high integrity and availability impact and no confidentiality impact per the CVSS 4.0 score of 7, which uses a local attack vector. Any application or service embedding an affected zstd-jni version is affected, particularly data-processing and streaming workloads that use compression dictionaries. There is currently no public proof of concept, the issue is not in CISA KEV, and no in-the-wild exploitation is known.

What to do: Upgrade zstd-jni to 1.5.7-14 or later. Until then, review application code to ensure dictionaries are never closed while any stream or context still references them, and treat unexplained data corruption or JVM crashes in compression paths as possible symptoms. Audit dependency trees (e.g., mvn dependency:tree or Gradle equivalents) for transitive zstd-jni versions bundled inside frameworks and clients.