zstd-jni Memory Read Vulnerability via Invalid Offset Handling

Executive Summary

CVE-2026-87795 is an out-of-bounds memory read vulnerability in zstd-jni versions before 1.5.7-14. The issue occurs in the ZstdDictCompress constructor, which fails to properly validate offset and length parameters. Attackers can supply manipulated values to read native heap memory into the compression dictionary, typically causing JVM crashes or leaking sensitive data.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the version of zstd-jni in your system. If you are using versions before 1.5.7-14, the system is vulnerable. Run: mvn dependency:tree | grep zstd-jni for Maven projects or gradle dependencies | grep zstd-jni for Gradle projects to verify the installed version.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to denial-of-service attacks by crashing the JVM when attackers supply malicious offset or length values. It may also allow information disclosure if sensitive heap memory is leaked into the compression dictionary. Systems using vulnerable zstd-jni versions are at risk if they process untrusted input.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements under GDPR and HIPAA by enabling unauthorized data access or disclosure. GDPR mandates protection against data breaches, while HIPAA requires safeguards for sensitive health information. Exploitation may lead to regulatory penalties due to compromised data integrity or confidentiality.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade zstd-jni to version 1.5.7-14 or later immediately. This version includes proper bounds checking to prevent out-of-bounds memory reads. Remove or replace any vulnerable versions in your dependencies.

Useful 0 Not Useful 0