CVE-2026-87824
zstd-jni 1.3.3-1 through 1.5.7-13 Out-of-Bounds Read via Zstd.trainFromBufferDirect
zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect, allowing attackers to read past buffer boundaries by supplying oversized per-sample lengths. Attackers can trigger out-of-bounds memory access by providing crafted sample length arrays that cause the native implementation to walk past the buffer allocation, resulting in JVM termination.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
zstd-jni 1.3.3-1 through 1.5.7-13 Out-of-Bounds Read via Zstd.trainFromBufferDirect
zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect, allowing attackers to read past buffer boundaries by supplying oversized per-sample lengths. Attackers can trigger out-of-bounds memory access by providing crafted sample length arrays that cause the native implementation to walk past the buffer allocation, resulting in JVM termination.
- Record
CVE-2026-87824- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
EUVDEUVD-2026-75022
zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect, allowing attackers to read past buffer boundaries by supplying oversized per-sample lengths. Attackers can trigger out-of-bounds memory access by providing crafted sample length arrays that cause the native implementation to walk past the buffer allocation, resulting in JVM termination.
- Record
EUVD-2026-75022- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-v36p-vv44-8qfg
zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd...
zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect, allowing attackers to read past buffer boundaries by supplying oversized per-sample lengths. Attackers can trigger out-of-bounds memory access by providing crafted sample length arrays that cause the native implementation to walk past the buffer allocation, resulting in JVM termination.
- Record
GHSA-v36p-vv44-8qfg- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
NVD
zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect, allowing attackers to read past buffer boundaries by supplying oversized per-sample lengths. Attackers can trigger out-of-bounds memory access by providing crafted sample length arrays that cause the native implementation to walk past the buffer allocation, resulting in JVM termination.
- Record
CVE-2026-87824- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSV
zstd-jni 1.3.3-1 through 1.5.7-13 Out-of-Bounds Read via Zstd.trainFromBufferDirect
zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect, allowing attackers to read past buffer boundaries by supplying oversized per-sample lengths. Attackers can trigger out-of-bounds memory access by providing crafted sample length arrays that cause the native implementation to walk past the buffer allocation, resulting in JVM termination.
- Record
CVE-2026-87824- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-87824
zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect, allowing attackers to read past buffer boundaries by supplying oversized per-sample lengths. Attackers can trigger out-of-bounds memory access by providing crafted sample length arrays that cause the native implementation to walk past the buffer allocation, resulting in JVM termination.
- Record
DEBIAN-CVE-2026-87824- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2026-87824
zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect, allowing attackers to read past buffer boundaries by supplying oversized per-sample lengths. Attackers can trigger out-of-bounds memory access by providing crafted sample length arrays that cause the native implementation to walk past the buffer allocation, resulting in JVM termination.
- Record
UBUNTU-CVE-2026-87824- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21902-1 No score
Security update for zstd-jni
This update for zstd-jni fixes the following issues:
- CVE-2026-87823: denial of Service or Information Disclosure via out-of-bounds read (bsc#1279953).
- CVE-2026-87824: denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect (bsc#1279956).
- CVE-2026-87825: use-after-free resulting in silent data corruption or JVM crashes (bsc#1279955).
- CVE-2026-87877: use-After-Free vulnerability allows memory corruption and denial of service (bsc#1279954).
Changes for zstd-jni:
- update to version v1.5.7.16.
- Record
openSUSE-SU-2026:21902-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:23858-1 No score
Security update for zstd-jni
This update for zstd-jni fixes the following issues:
- CVE-2026-87823: denial of Service or Information Disclosure via out-of-bounds read (bsc#1279953).
- CVE-2026-87824: denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect (bsc#1279956).
- CVE-2026-87825: use-after-free resulting in silent data corruption or JVM crashes (bsc#1279955).
- CVE-2026-87877: use-After-Free vulnerability allows memory corruption and denial of service (bsc#1279954).
Changes for zstd-jni:
- update to version v1.5.7.16.
- Record
SUSE-SU-2026:23858-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:23868-1 No score
Security update for zstd-jni
This update for zstd-jni fixes the following issues:
- CVE-2026-87823: denial of Service or Information Disclosure via out-of-bounds read (bsc#1279953).
- CVE-2026-87824: denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect (bsc#1279956).
- CVE-2026-87825: use-after-free resulting in silent data corruption or JVM crashes (bsc#1279955).
- CVE-2026-87877: use-After-Free vulnerability allows memory corruption and denial of service (bsc#1279954).
Changes for zstd-jni:
- update to version v1.5.7.16.
- Record
SUSE-SU-2026:23868-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
zstd-jni-javaDebian:12 |
All versions, plus listed versions 1.5.2-5+ds-31.5.2-5+ds-41.5.2-5+ds-51.5.2-5+ds-61.5.2-5+ds-7 Show 9 moreShow less1.5.2-5+ds-81.5.4-2+ds-11.5.4-2+ds-21.5.4-2+ds-3~exp11.5.4-2+ds-3~exp21.5.4-2+ds-3~exp31.5.4-2+ds-3~exp41.5.7-23+ds-11.5.7-23+ds-2 |
None known |
zstd-jni-javaDebian:13 |
All versions, plus listed versions 1.5.2-5+ds-71.5.2-5+ds-81.5.4-2+ds-11.5.4-2+ds-21.5.4-2+ds-3~exp1 Show 5 moreShow less1.5.4-2+ds-3~exp21.5.4-2+ds-3~exp31.5.4-2+ds-3~exp41.5.7-23+ds-11.5.7-23+ds-2 |
None known |
zstd-jni-javaDebian:14 |
before 1.5.7-23+ds-1, plus listed versions 1.5.2-5+ds-71.5.2-5+ds-81.5.4-2+ds-11.5.4-2+ds-21.5.4-2+ds-3~exp11.5.4-2+ds-3~exp21.5.4-2+ds-3~exp31.5.4-2+ds-3~exp4 |
1.5.7-23+ds-1 |
zstd-jniSUSE:Linux Enterprise Server 16.0 From an advisory covering 4 CVEs |
before 1.5.7.16-160000.1.1 | 1.5.7.16-160000.1.1 |
zstd-jniSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 4 CVEs |
before 1.5.7.16-160000.1.1 | 1.5.7.16-160000.1.1 |
zstd-jni-javaUbuntu:24.04:LTS |
All versions, plus listed versions 1.5.2-5+ds-31.5.2-5+ds-3build1 |
None known |
zstd-jni-javaUbuntu:26.10 |
All versions, plus listed versions 1.5.2-5+ds-8 |
None known |
zstd-jni-javaUbuntu:26.04:LTS |
All versions, plus listed versions 1.5.2-5+ds-71.5.2-5+ds-7build11.5.2-5+ds-7ubuntu11.5.2-5+ds-8 |
None known |
zstd-jniopenSUSE:Leap 16.0 From an advisory covering 4 CVEs |
before 1.5.7.16-160000.1.1 | 1.5.7.16-160000.1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-87824 is a high vulnerability (CVSS 8.7) in Luben Zstd-jni, published September 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 33rd percentile. Fixed in zstd-jni-java 1.5.7-23+ds-1.
References
github.com/luben/zstd-jni/security/advisories/GHSA-257p-3h6w-pg7h
Show 19 moreShow less
vulncheck.com/advisories/zstd-jni-1.3.3-1-through-1.5.7-13-out-of-bounds-read-via-zstd-trainfrombufferdirect
nvd.nist.gov/vuln/detail/CVE-2026-87824
repo1.maven.org/maven2/com/github/luben/zstd-jni
security-tracker.debian.org/tracker/CVE-2026-87824
suse.com/support/update/announcement/2026/suse-su-202623858-1
bugzilla.suse.com/1279953
ubuntu.com/security/CVE-2026-87824
cve.org/CVERecord?id=CVE-2026-87824