CVE-2026-87877 zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()
Attackers can trigger use-after-free in zstd-jni by calling setters on closed streams, leading to JVM crashes or potential code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-87877?
CVE-2026-87877 is a high-severity use after free vulnerability in luben zstd-jni, published on 9 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM.
Weakness: CWE-416
Which versions are affected by CVE-2026-87877?
How do I fix CVE-2026-87877?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-87877 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-87877 exists.
Sources
Also known as CLEANSTART-2026-BT92518, CLEANSTART-2026-BW94904, CLEANSTART-2026-FB66961, CLEANSTART-2026-GA54937, CLEANSTART-2026-LQ70759, CLEANSTART-2026-ZY12468 and 4 more.