PT-2026-91849

CVE-2026-90852

Published

2026-09-15

Updated

2026-10-30

Description by

CVSS 2.0

7.5

High

MetricsAV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions luben zstd-jni versions prior to 1.5.7-14

Description A remote attack can trigger a use after free condition within the Dictionary Sharing component. This issue occurs in the ZstdCompressCtx.loadDict() function located in the ZstdCompressCtx.java file. Use after free is a memory corruption issue where an application continues to use a pointer after it has been freed, which can lead to crashes or arbitrary code execution.

Recommendations Upgrade to version 1.5.7-14.

Exploitability

Exploit

Fix

Impacts

Researchers

Yu Bao

Vendors

Affected products

Weakness enumeration

CWE-416: Use After Free

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer