CVE-2026-87824

Awaiting Analysis Awaiting Analysis - Queue

Heap Overflow in zstd-jni Java Library

Publication date: 2026-09-09

Last updated on: 2026-09-20

Assigner: VulnCheck

Description

zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect, allowing attackers to read past buffer boundaries by supplying oversized per-sample lengths. Attackers can trigger out-of-bounds memory access by providing crafted sample length arrays that cause the native implementation to walk past the buffer allocation, resulting in JVM termination.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-20

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-87824

EUVD

EUVD-2026-75022

Affected Vendors & Products

Vendor	Product	Version / Range
luben	zstd-jni	to 1.5.7-14 (exc)
luben	zstd-jni	1.5.7-13
luben	zstd-jni	1.3.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

CVE-2026-87824 is an out-of-bounds read vulnerability in zstd-jni versions 1.3.3-1 through 1.5.7-13. It occurs in the Zstd.trainFromBufferDirect method where the library fails to validate the samples buffer capacity against declared sample sizes. Attackers can supply oversized per-sample lengths, causing the native implementation to read past the allocated buffer boundaries. This leads to out-of-bounds memory access and potential JVM termination.

Detection Guidance

Check zstd-jni version with: mvn dependency:tree | grep zstd-jni. If using 1.3.3-1 through 1.5.7-13, the system is vulnerable. Monitor JVM crashes during dictionary training operations as they may indicate exploitation attempts.

Impact Analysis

This vulnerability can cause denial of service by crashing the JVM when attackers trigger out-of-bounds memory access. In some cases, it may also lead to information disclosure if the memory overrun stays within mapped memory. The impact is significant as it requires no privileges or user interaction and can be exploited remotely.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling denial-of-service attacks through JVM termination or memory exhaustion. GDPR requires data protection measures to ensure availability and integrity of personal data, while HIPAA mandates safeguards against unauthorized access or disruptions. The out-of-bounds read flaw may lead to system instability, violating these requirements if exploited.

Mitigation Strategies

Upgrade zstd-jni to version 1.5.7-14 or later immediately. If upgrading is not possible, restrict access to applications using zstd-jni or disable dictionary training features until patched.

Hi! I’m here to help you understand CVE-2026-87824. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70