Out-of-Bounds Memory Read in zstd-jni

The zstd-jni library, which provides Java bindings for the Zstandard compression algorithm, contains a memory safety vulnerability identified as CVE-2026-87795. The flaw exists within the ZstdDictCompress constructor, where the library fails to properly validate the offset and length parameters provided during dictionary creation.

By supplying specially crafted offset or length values to the constructor, an attacker can trigger an out-of-bounds read within the native heap. This action potentially allows sensitive memory contents to be pulled into the compression dictionary. While the primary documented outcome is a JVM crash due to memory corruption, the underlying primitive provides a mechanism for information disclosure. The vulnerability affects all versions of zstd-jni prior to 1.5.7-14. This is particularly relevant for Java applications that process untrusted data using the ZstdDictCompress functionality, as the lack of parameter validation enables an attacker to manipulate memory access patterns directly.

Impact

Successful exploitation leads to memory corruption, which most commonly results in a denial-of-service condition via JVM crash. However, the out-of-bounds read capability poses a significant risk of information disclosure, where sensitive data residing in the native heap may be leaked into the application's compression dictionary. Applications that handle high-privilege or sensitive data and utilize zstd-jni for compression tasks are at the highest risk.

Recommendation

Prioritize the update of all Java applications utilizing the zstd-jni library to version 1.5.7-14 or later to resolve the input validation issue in CVE-2026-87795.

Audit application codebases to identify if ZstdDictCompress is invoked with parameters derived from untrusted user input, as this represents the primary attack vector for this vulnerability.