CVE-2026-93452 snappy-java through 1.1.10.8 Buffer Overflow in Snappy.compress
Attackers can cause JVM termination by supplying incompressible data to snappy-java, leading to a buffer overflow and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-93452?
CVE-2026-93452 is a high-severity memory corruption vulnerability in xerial snappy-java, published on 17 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in Snappy.compress(ByteBuffer, ByteBuffer) that writes past the end of the destination buffer. Attackers can supply incompressible data that exceeds the destination buffer's remaining capacity, corrupting off-heap memory and causing JVM termination.
Weakness: CWE-787
Which versions are affected by CVE-2026-93452?
How do I fix CVE-2026-93452?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-93452 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-93452 exists.
Sources
Also known as CLEANSTART-2026-HC59767, CLEANSTART-2026-RU43979, CLEANSTART-2026-UM59263, CLEANSTART-2026-ZO24294, ECHO-88ee-645b-e5d6, GHSA-pm27-vjq7-f5fv and 1 more.