CVE-2026-87877
zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()
- State
- Published
- Severity
- 7.0 High
- Published
- Sep 9, 2026
- Updated
- Sep 9, 2026
- Reserved
- Sep 9, 2026
Description
zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.0 High | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.7 High | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H | VulnCheck |
Weaknesses
- CWE-416 Use After Free
Affected Products
| Product | Versions |
|---|---|
zstd-jniluben |
|
References
- GitHub Security Advisory (GHSA-2jw3-mg7f-vw4q)vendor-advisory
- Fix commit: closed-state guards on BaseZstdBufferDecompressingStreamNoFinalizerpatch
- Fix commit: closed-state guards on the input and output stream setterspatch
- Setters without the closed-state guard that readInternal already has, at v1.5.7-13technical-description
- final stream handle retained after close at v1.5.7-13technical-description
- zstd-jni v1.5.7-14 Release Notesrelease-notes
- Commit that made setDict write through the retained native stream handle (first released in 1.3.8-4)technical-descriptionpatch
- https://github.com/luben/zstd-jniproduct
- VulnCheck Advisory: zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.