CVE-2026-87823: Luben Zstd-Jni

High severity, CVSS 8.2. EPSS: 0.4% chance of exploitation in the next 30 days.

zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MIN_VALUE to read unmapped memory, causing JVM termination or extracting arbitrary frame size data from unintended memory locations.

Affected products

• Luben Zstd-Jni: from 1.1.1, before 1.5.7-14 (fixed in 1.5.7-14)

Published 2026-09-09. Last modified 2026-09-09.