Impact

The vulnerability results in a high-severity denial-of-service condition due to the crash of the host JVM. Applications that accept user-provided training samples for Zstandard dictionary building are at risk of repeated service interruption or potential instability if the native memory corruption leads to unpredictable process states before the final crash occurs.

Recommendation

• Upgrade the zstd-jni dependency to version 1.5.7-14 or later to remediate CVE-2026-87824.
• Audit all application entry points that pass user-supplied input to Zstd.trainFromBufferDirect to ensure that input length arrays are validated against expected bounds before processing.
• Monitor application logs for sudden JVM process exits accompanied by native crash dumps (hs_err_pid files) that indicate errors within the libzstd-jni native library.

By supplying specially crafted offset or length values to the constructor, an attacker can trigger an out-of-bounds read within the native heap. This action potentially allows sensitive memory contents to be pulled into the compression dictionary. While the primary documented outcome is a JVM crash due to memory corruption, the underlying primitive provides a mechanism for information disclosure. The vulnerability affects all versions of zstd-jni prior to 1.5.7-14. This is particularly relevant for Java applications that process untrusted data using the ZstdDictCompress functionality, as the lack of parameter validation enables an attacker to manipulate memory access patterns directly.

Impact

Successful exploitation leads to memory corruption, which most commonly results in a denial-of-service condition via JVM crash. However, the out-of-bounds read capability poses a significant risk of information disclosure, where sensitive data residing in the native heap may be leaked into the application's compression dictionary. Applications that handle high-privilege or sensitive data and utilize zstd-jni for compression tasks are at the highest risk.

Recommendation

Prioritize the update of all Java applications utilizing the zstd-jni library to version 1.5.7-14 or later to resolve the input validation issue in CVE-2026-87795.

Audit application codebases to identify if ZstdDictCompress is invoked with parameters derived from untrusted user input, as this represents the primary attack vector for this vulnerability.