CVE-2026-87877
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()
zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
zstd-jni
- Vendor
- luben
- Product
- zstd-jni
- Platforms
- Unknown
- Default status
unaffected- Package collection
- https://repo1.maven.org/maven2/com/github/luben/zstd-jni/
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 1.3.8-4 | affected | custom | 1.5.7-14 | Unavailable | None listed |