CVE-2026-87795highCWE-125

CVE-2026-87795: fallo de gravedad alta en luben zstd-jni

zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictCompress

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear zstd-jni+ Monitorear zstd-jni-java

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.8epss 0.6%
zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or length values to read native heap memory into the compression dictionary, typically causing JVM crashes.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
Productos afectados
luben · zstd-jni
CVEs relacionadas — luben zstd-jni

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-89046HIGHzstd-jni 1.5.5-6 through 1.5.7-13 Out-of-Bounds Read via Negative OffsetEPSS 0.7%CVE-2026-90560HIGHzstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictDecompressEPSS 0.6%CVE-2026-90852MEDIUMluben zstd-jni Dictionary Sharing ZstdCompressCtx.java ZstdCompressCtx.loadDict use after freeEPSS 0.5%CVE-2026-87823HIGHzstd-jni 1.1.1 through 1.5.7-13 Out-of-Bounds Read via Direct ByteBuffer Frame-Size MethodsEPSS 0.4%CVE-2026-87824HIGHzstd-jni 1.3.3-1 through 1.5.7-13 Out-of-Bounds Read via Zstd.trainFromBufferDirectEPSS 0.4%CVE-2026-87877HIGHzstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()EPSS 0.2%