CVE-2026-87823

Awaiting Analysis Awaiting Analysis - Queue

Heap Overflow in zstd-jni via Negative ByteBuffer Offsets

Publication date: 2026-09-09

Last updated on: 2026-09-09

Assigner: VulnCheck

Description

zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MIN_VALUE to read unmapped memory, causing JVM termination or extracting arbitrary frame size data from unintended memory locations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-09

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-87823

EUVD

EUVD-2026-75021

Affected Vendors & Products

Vendor	Product	Version / Range
luben	zstd-jni	to 1.5.7-14 (exc)
luben	zstd-jni	1.5.7-13
luben	zstd-jni	1.1.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

Executive Summary

CVE-2026-87823 is an out-of-bounds read vulnerability in zstd-jni versions 1.1.1 through 1.5.7-13. It affects three native methods that handle Direct ByteBuffer frame-size queries. The issue stems from improper 32-bit signed bounds checks, allowing attackers to supply negative offset values near Integer.MIN_VALUE. This bypasses buffer validation, causing memory reads outside intended bounds, potentially crashing the JVM or extracting arbitrary data from unintended memory locations.

Detection Guidance

To detect this vulnerability, check if your system uses zstd-jni versions 1.1.1 through 1.5.7-13. Run commands like 'find / -name "zstd-jni*.jar" 2>/dev/null' or 'mvn dependency:tree' in Java projects to identify the library version. If version 1.5.7-14 or later is not installed, the system is vulnerable.

Impact Analysis

This vulnerability can lead to denial-of-service (DoS) by crashing the JVM when malicious inputs are processed. It may also allow attackers to read sensitive memory contents, potentially exposing confidential data. Systems using vulnerable zstd-jni versions for compression or decompression tasks are at risk, especially those handling untrusted input.

Compliance Impact

This vulnerability primarily impacts data integrity and availability by enabling out-of-bounds memory reads, which could lead to JVM crashes or unauthorized memory access. While not directly violating GDPR or HIPAA, such memory corruption risks may compromise data confidentiality if exploited to extract sensitive information. Compliance frameworks like GDPR (Article 32) and HIPAA (Security Rule) require measures to ensure data integrity and availability, which this flaw undermines. Organizations using affected versions must patch to maintain compliance.

Mitigation Strategies

Upgrade zstd-jni to version 1.5.7-14 or later, which includes fixes for the bounds checking vulnerabilities.
Review and update any Java applications using zstd-jni to ensure they use the patched version.
Monitor for unusual JVM crashes or memory access errors, which may indicate exploitation attempts.

Hi! I’m here to help you understand CVE-2026-87823. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70