CVE-2026-87823

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-87823
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-87823.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-87823
Aliases
  • GHSA-jfr6-9xqw-2g2q
Downstream
Published
2026-09-09T14:32:43Z
Modified
2026-09-10T08:16:10Z
Severity
  • 8.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
zstd-jni 1.1.1 through 1.5.7-13 Out-of-Bounds Read via Direct ByteBuffer Frame-Size Methods
Details

zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MIN_VALUE to read unmapped memory, causing JVM termination or extracting arbitrary frame size data from unintended memory locations.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-190"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87823.json"
}
References

Affected packages

Git / github.com/luben/zstd-jni

Affected ranges

Type
GIT
Repo
https://github.com/luben/zstd-jni
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
3216860eea289fbbae0b191c0a4fd8b72dad949c
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "1.1.1"
        },
        {
            "fixed": "1.5.7-14"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*
1.4.4-4
b1.*
b1.5.5-9
c1.*
c1.5.2-5
v.*
v.1.3.8-9
v.1.5.5-5
v0.*
v0.1.1
v0.1.3
v0.2.1
v0.4.3
v0.4.4
v1.*
v1.2.0
v1.3.0-1
v1.3.1-1
v1.3.2-1
v1.3.2-2
v1.3.2-3
v1.3.3-1
v1.3.4-1
v1.3.4-10
v1.3.4-8
v1.3.5-1
v1.3.5-2
v1.3.5-3
v1.3.6-1
v1.3.7-1
v1.3.7-2
v1.3.7-3
v1.3.8-1
v1.3.8-2
v1.3.8-3
v1.3.8-4
v1.3.8-5
v1.3.8-6
v1.3.8-7
v1.3.8-8
v1.4.0-1
v1.4.1-1
v1.4.2-1
v1.4.3-1
v1.4.4-10
v1.4.4-11
v1.4.4-2
v1.4.4-3
v1.4.4-5
v1.4.4-7
v1.4.4-8
v1.4.4-9
v1.4.5-1
v1.4.5-10
v1.4.5-11
v1.4.5-12
v1.4.5-2
v1.4.5-3
v1.4.5-4
v1.4.5-6
v1.4.5-7
v1.4.5-8
v1.4.5-9
v1.4.7-1
v1.4.7-2
v1.4.7-3
v1.4.8-1
v1.4.8-2
v1.4.8-3
v1.4.8-4
v1.4.8-5
v1.4.8-6
v1.4.8-7
v1.4.9-1
v1.4.9-2
v1.4.9-3
v1.4.9-4
v1.4.9-5
v1.5.0-1
v1.5.0-2
v1.5.0-3
v1.5.0-4
v1.5.0-5
v1.5.1-1
v1.5.2-1
v1.5.2-2
v1.5.2-3
v1.5.4-1
v1.5.4-2
v1.5.5-1
v1.5.5-10
v1.5.5-11
v1.5.5-2
v1.5.5-3
v1.5.5-6
v1.5.5-7
v1.5.5-8
v1.5.5-9
v1.5.6-1
v1.5.6-10
v1.5.6-2
v1.5.6-3
v1.5.6-4
v1.5.6-5
v1.5.6-6
v1.5.6-7
v1.5.6-8
v1.5.6-9
v1.5.7-1
v1.5.7-11
v1.5.7-12
v1.5.7-13
v1.5.7-2
v1.5.7-3
v1.5.7-4
v1.5.7-5
v1.5.7-6
v1.5.7-7
v1.5.7-8
v1.5.7-9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-87823.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "319696483832917712384682231278816072707",
            "length": 525
        },
        "id": "CVE-2026-87823-44dbbae1",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c",
        "target": {
            "file": "src/main/native/jni_zstd.c",
            "function": "Java_com_github_luben_zstd_Zstd_getDirectByteBufferFrameContentSize"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "242983979289756636978174893894911169283",
                "157823411836278810979700492519583258858",
                "47982388172284482667079231190836641912",
                "142002538935986523140505977783435642687",
                "70654406038950244899492554068964697791",
                "256841266079176367404669460587415964017",
                "136130365917502750732790875301653462261",
                "307914870517560413069750160813139035083",
                "70654406038950244899492554068964697791",
                "256841266079176367404669460587415964017",
                "136130365917502750732790875301653462261",
                "307914870517560413069750160813139035083"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-87823-cf1cd55a",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c",
        "target": {
            "file": "src/main/native/jni_zstd.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "6130561471615133004258603361745015963",
            "length": 503
        },
        "id": "CVE-2026-87823-e402cad3",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c",
        "target": {
            "file": "src/main/native/jni_zstd.c",
            "function": "Java_com_github_luben_zstd_Zstd_findDirectByteBufferFrameCompressedSize"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "243452810049814927721413726162029308560",
            "length": 552
        },
        "id": "CVE-2026-87823-e43e017d",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c",
        "target": {
            "file": "src/main/native/jni_zstd.c",
            "function": "Java_com_github_luben_zstd_Zstd_decompressedDirectByteBufferSize"
        }
    }
]
vanir_signatures_modified 
"2026-09-10T08:16:10Z"