CVE-2026-87877highCWE-416

CVE-2026-87877: fallo de gravedad alta en luben zstd-jni

zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()

Publicada el

Seguir esta CVE+ Monitorear zstd-jni+ Monitorear zstd-jni-java

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7epss 0.2%
zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
luben · zstd-jni
CVEs relacionadas — luben zstd-jni

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-89046HIGHzstd-jni 1.5.5-6 through 1.5.7-13 Out-of-Bounds Read via Negative OffsetEPSS 0.7%CVE-2026-87795HIGHzstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictCompressEPSS 0.6%CVE-2026-90560HIGHzstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictDecompressEPSS 0.6%CVE-2026-90852MEDIUMluben zstd-jni Dictionary Sharing ZstdCompressCtx.java ZstdCompressCtx.loadDict use after freeEPSS 0.5%CVE-2026-87823HIGHzstd-jni 1.1.1 through 1.5.7-13 Out-of-Bounds Read via Direct ByteBuffer Frame-Size MethodsEPSS 0.4%CVE-2026-87824HIGHzstd-jni 1.3.3-1 through 1.5.7-13 Out-of-Bounds Read via Zstd.trainFromBufferDirectEPSS 0.4%