CVE-2026-87824
highpriority · track · 30EPSS 0.004 · 33 %ileDEFRRUEPSS · scored 2026-10-27
zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect, allowing attackers to read past buffer boundaries by supplying oversized per-sample lengths. Attackers can trigger out-of-bounds memory access by providing crafted sample length arrays that cause the native implementation to walk past the buffer allocation, resulting in JVM termination.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.6–8.7
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (4)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-3791IBM SPSS: Mehrere SchwachstellenDeutsch2026-10-06csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in IBM SPSS ausnutzen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen und um Dateien zu manipulieren.
- CERTFR-2026-AVI-1336Multiples vulnérabilités dans les produits IBMFrançais2026-10-16vendor · certfrFR
also known as (2)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (8) nvd
External citations — patches, advisories, analysis.
- https://github.com/luben/zstd-jni
- https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/Zstd.java
- https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_zdict.c
- https://github.com/luben/zstd-jni/commit/53d3c6342883f7d6717b2477a7f9c1b4a4a56980
- https://github.com/luben/zstd-jni/commit/bba6cfca2c0897f1fa004f4193247479f10da853
- https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14
- https://github.com/luben/zstd-jni/security/advisories/GHSA-257p-3h6w-pg7h
- https://www.vulncheck.com/advisories/zstd-jni-1.3.3-1-through-1.5.7-13-out-of-bounds-read-via-zstd-trainfrombufferdirect
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan