HIGHVulnerability
CVE-2026-87795
zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or length values to read native heap memory into the compression dictionary, typically causing JVM crashes.
Properties
- severity
- HIGH
- score
- 8.2
- cve_id
- CVE-2026-87795
- signal_observed_at
- 2026-09-17T21:32:24+00:00
- vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
- published_at
- 2026-09-09T10:22:34.557
- last_modified
- 2026-09-14T13:19:00.180
Related Entities (2)
HAS_WEAKNESS (1)
→[Weakness]Out-of-bounds Read
DESCRIBED_BY (1)
→[Source]NVD
Explore deeper with Ninja Signal's threat intelligence graph