CVE-2026-87877

zstd-jni, the Java JNI binding for the Zstandard compression library, fails to validate whether a stream has already been closed before processing calls to the setDict, setLongMax, setLevel and setRefMultipleDDicts methods of its stream classes in versions before 1.5.7-14 (CWE-416, use-after-free). The flaw is triggered whenever an application calls any of these setter methods on a stream object after close(), causing the library to write through native pointers that have already been freed. An attacker who can influence those calls gains corruption of unrelated native heap objects or a crash of the host JVM; the CVSS 4.0 vector is local (AV:L) with no confidentiality impact but high integrity and availability impact, so exploitation depends on attacker-controlled or faulty application code reaching the library in-process rather than direct network access. Any Java application, server, or big-data/messaging deployment that bundles an affected zstd-jni version, directly or transitively, is affected until it is updated. No public proof of concept, CISA KEV listing, or in-the-wild exploitation is currently known.

What to do: Upgrade zstd-jni to 1.5.7-14 or later and rebuild/redeploy any application that bundles it, checking dependency trees (mvn dependency:tree, gradle dependencies) for transitive copies pulled in by messaging or big-data frameworks. As an interim mitigation, ensure application code never calls setDict, setLongMax, setLevel or setRefMultipleDDicts on a stream after close(). Since the attack vector is local/in-process, prioritize patched rebuilds of long-lived JVM services and treat unexplained JVM crashes or native memory corruption in compression workloads as a signal to check the bundled zstd-jni version.