Zstd-Jni (< 1.5.7-14)

The zstd-jni library fails to validate sample buffer capacity in the Zstd.trainFromBufferDirect method, allowing attackers to trigger out-of-bounds memory access and JVM termination via crafted inputs.

The zstd-jni library versions prior to 1.5.7-14 are vulnerable to an out-of-bounds memory read in the ZstdDictCompress constructor, allowing local or remote attackers to read native heap memory into a compression dictionary.