Executive brief
zstd-jni is a Java library providing compression functionality through native bindings. A flaw in the getFrameContentSize method allows attackers to bypass bounds checks using negative offset values, leading to out-of-bounds memory reads that can disclose sensitive information or crash the Java application.
Technical details
The vulnerability is an out-of-bounds read in the Zstd.getFrameContentSize method caused by insufficient validation of the srcPosition parameter. Attackers can supply negative srcPosition values that bypass bounds checks and reach the native frame-header parser, triggering out-of-bounds memory access. The attack requires the ability to call getFrameContentSize with attacker-controlled input; no authentication is required. Exploitation can lead to information disclosure through memory leakage or denial-of-service via JVM crash. Versions 1.5.5-6 through 1.5.7-13 are affected; patched versions are 1.5.7-14 and later.
Affected products
- GitHub zstd-jni 1.5.5-6 through 1.5.7-13
Timeline
- 2026-09-10: disclosed