CVE-2026-87825

Awaiting Analysis Awaiting Analysis - Queue

Use-After-Free in zstd-jni Java Library

Publication date: 2026-09-09

Last updated on: 2026-09-14

Assigner: VulnCheck

Description

zstd-jni before 1.5.7-14 contains a use-after-free vulnerability where streams and contexts hold a dictionary's shared lock only during the load call, allowing the dictionary to be closed while still referenced. Attackers can close a dictionary after associating it with a stream or context, causing subsequent read or write operations to access freed native memory, resulting in silent data corruption or JVM crashes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-14

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-87825

EUVD

EUVD-2026-75023

Affected Vendors & Products

Vendor	Product	Version / Range
luben	zstd-jni	to 1.5.7-14 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in zstd-jni before version 1.5.7-14. Streams and contexts hold a dictionary's shared lock only during the load call, allowing the dictionary to be closed while still referenced. Attackers can close a dictionary after associating it with a stream or context, causing subsequent operations to access freed native memory. This leads to silent data corruption or JVM crashes.

Detection Guidance

To detect this vulnerability, check the version of zstd-jni in use. If your system uses versions 1.3.8-4 through 1.5.7-13, it is vulnerable. Run commands like 'mvn dependency:tree' for Maven projects or 'gradle dependencies' for Gradle projects to inspect the zstd-jni version.

Impact Analysis

The vulnerability can cause silent data corruption during compression or decompression operations. It may also lead to JVM crashes (SIGSEGV), disrupting applications relying on zstd-jni. Exploitable by closing a dictionary after associating it with a stream or context, even in single-threaded scenarios.

Compliance Impact

This vulnerability could lead to silent data corruption or JVM crashes during compression or decompression operations. For GDPR, this may result in unauthorized data processing or loss of data integrity, violating principles of accuracy and security. For HIPAA, it could cause corruption of protected health information during storage or transmission, compromising confidentiality and availability requirements.

Mitigation Strategies

Upgrade zstd-jni to version 1.5.7-14 or later. This version includes fixes for proper lock management and dictionary lifetime tracking, preventing use-after-free issues.

Hi! I’m here to help you understand CVE-2026-87825. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70