CVE-2026-89046

zstd-jni, the widely used Java JNI binding for the Zstandard (zstd) compression library, contains an out-of-bounds read (CWE-125) in the Zstd.getFrameContentSize method. The method fails to validate negative srcPosition arguments, allowing an out-of-range offset to bypass bounds checks and reach the native frame-header parser, which reads memory outside the intended source buffer. An attacker who can control the position argument passed by an application can disclose adjacent memory contents or crash the JVM, causing a denial of service. Any Java/JVM application or server that bundles an affected zstd-jni release (1.5.5-6 through 1.5.7-13) and calls this API with attacker-influenced offsets is affected. There is currently no evidence of in-the-wild exploitation, no known public proof-of-concept, and the issue is not listed in CISA's KEV.

What to do: Upgrade to a zstd-jni release newer than 1.5.7-13 as soon as a patched version is published. Until then, audit your dependency trees (e.g., mvn dependency:tree or gradle dependencies) for affected versions and validate or clamp srcPosition arguments before calling Zstd.getFrameContentSize, ensuring negative offsets are never passed through. Prioritize environments where untrusted input can influence decompression calls.