Executive brief
zstd-jni is a Java library providing native compression/decompression via the Zstandard algorithm. The library performs inadequate bounds checking on negative or overflowing offset values when processing DirectByteBuffer frames, allowing attackers to read unmapped memory regions. This can cause JVM crashes or disclosure of sensitive data from arbitrary memory locations.
Technical details
The vulnerability exists in three native methods that process direct-ByteBuffer frame sizes, which use 32-bit signed integer bounds checks. An attacker can supply offset values near Integer.MIN_VALUE to bypass these checks, triggering out-of-bounds memory reads via integer overflow. The methods are network-reachable if zstd-jni is used to decompress untrusted data. Successful exploitation results in JVM termination or extraction of arbitrary frame size data from unintended memory locations. Affected versions are before 1.5.7-14; the fix corrects the bounds validation logic.
Affected products
- Luben zstd-jni before 1.5.7-14
Timeline
- 2026-09-09: disclosed
- 2026-08-16: patched: Version 1.5.7-14 released with fix