CVE-2026-87877

Published: Sep 9, 2026Modified: Sep 9, 2026

7.0

Vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM.

Related CWEs

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

References (10)

https://github.com/luben/zstd-jni

Source: disclosure@vulncheck.com

https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java

Source: disclosure@vulncheck.com

https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java

Source: disclosure@vulncheck.com

https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938

Source: disclosure@vulncheck.com

https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555

Source: disclosure@vulncheck.com

https://github.com/luben/zstd-jni/commit/f38f9a1563113d96d0fc38baee543f7457dd8a8e

Source: disclosure@vulncheck.com

https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14

Source: disclosure@vulncheck.com

https://github.com/luben/zstd-jni/security/advisories/GHSA-2jw3-mg7f-vw4q

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/zstd-jni-1.3.8-4-through-1.5.7-13-use-after-free-via-setters-called-after-close

Source: disclosure@vulncheck.com

https://github.com/luben/zstd-jni/security/advisories/GHSA-2jw3-mg7f-vw4q

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.