CVE-2026-87823 zstd-jni 1.1.1 through 1.5.7-13 Out-of-Bounds Read via Direct ByteBuffer Frame-Size Methods
Attackers can trigger out-of-bounds memory reads in zstd-jni via integer overflows, causing JVM crashes or data disclosure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-87823?
CVE-2026-87823 is a high-severity vulnerability in luben zstd-jni, published on 9 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MIN_VALUE to read unmapped memory, causing JVM termination or extracting arbitrary frame size data from unintended memory locations.
Weakness: CWE-190
Which versions are affected by CVE-2026-87823?
How do I fix CVE-2026-87823?
Upgrade to a fixed version.
Is CVE-2026-87823 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-87823 exists.
Sources
Also known as CLEANSTART-2026-BK85546, CLEANSTART-2026-CC37311, CLEANSTART-2026-RI59675, CLEANSTART-2026-UA88149, CLEANSTART-2026-UC40793, CLEANSTART-2026-VU34498 and 4 more.