Executive brief
zstd-jni is a Java native interface binding for Zstandard, a compression library widely used in data processing and storage applications. A use-after-free vulnerability in the dictionary sharing functionality could allow remote attackers to cause crashes or execute arbitrary code, potentially compromising systems that rely on this library for compression operations.
Technical details
The vulnerability is a use-after-free flaw in the ZstdCompressCtx.loadDict() method of the Dictionary Sharing component in zstd-jni. The issue stems from improper lifetime tracking of dictionary objects when shared across compression contexts, allowing an attacker to reference freed memory. The attack is remotely exploitable without requiring authentication or user interaction. An attacker can trigger the vulnerability to cause denial of service or potentially achieve remote code execution. The vulnerability was patched in version 1.5.7-14 (commit a560131d7834598afd9cea6b7c107bc88e915936), which implements proper cross-object lifetime tracking.
Affected products
- luben zstd-jni up to 1.5.7-13
Timeline
- 2026-09-15: disclosed
- 2026-09-15: patched: Version 1.5.7-14 released with patch a560131d7834598afd9cea6b7c107bc88e915936