CVE-2026-87795 zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictCompress
Attackers can trigger out-of-bounds memory reads in zstd-jni by supplying invalid parameters, causing JVM crashes and potential information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-87795?
CVE-2026-87795 is a high-severity memory corruption vulnerability in luben zstd-jni, published on 9 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or length values to read native heap memory into the compression dictionary, typically causing JVM crashes.
Weakness: CWE-125
Which versions are affected by CVE-2026-87795?
How do I fix CVE-2026-87795?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-87795 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-87795 exists.
Sources
Also known as CLEANSTART-2026-KX25709, CLEANSTART-2026-NE87407, CLEANSTART-2026-UR93558, CLEANSTART-2026-VU86265, CLEANSTART-2026-YH80371, CLEANSTART-2026-ZO58617 and 4 more.