CVE-2026-87823

Name of the Vulnerable Software and Affected Versions zstd-jni versions prior to 1.5.7-14

Description The software performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, which allows out-of-bounds memory reads through negative or overflowing offsets. An attacker can provide negative offset values near Integer.MIN VALUE to read unmapped memory, potentially leading to JVM termination or the extraction of arbitrary frame size data from unintended memory locations.

Recommendations Update to version 1.5.7-14 or later.