By supplying specially crafted offset or length values to the constructor, an attacker can trigger an out-of-bounds read within the native heap. This action potentially allows sensitive memory contents to be pulled into the compression dictionary. While the primary documented outcome is a JVM crash due to memory corruption, the underlying primitive provides a mechanism for information disclosure. The vulnerability affects all versions of zstd-jni prior to 1.5.7-14. This is particularly relevant for Java applications that process untrusted data using the ZstdDictCompress functionality, as the lack of parameter validation enables an attacker to manipulate memory access patterns directly.

Impact

Successful exploitation leads to memory corruption, which most commonly results in a denial-of-service condition via JVM crash. However, the out-of-bounds read capability poses a significant risk of information disclosure, where sensitive data residing in the native heap may be leaked into the application's compression dictionary. Applications that handle high-privilege or sensitive data and utilize zstd-jni for compression tasks are at the highest risk.

Recommendation

Prioritize the update of all Java applications utilizing the zstd-jni library to version 1.5.7-14 or later to resolve the input validation issue in CVE-2026-87795.

Audit application codebases to identify if ZstdDictCompress is invoked with parameters derived from untrusted user input, as this represents the primary attack vector for this vulnerability.