CVE-2026-87823

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-87823
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-87823.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-87823
Aliases
  • GHSA-jfr6-9xqw-2g2q
Downstream
CLEANSTART (6)
DEBIAN (1)
openSUSE (2)
SUSE (2)
UBUNTU (1)
Related
openSUSE (2)
SUSE (2)
Published
2026-09-09T14:32:43Z
Modified
2026-10-21T11:19:18Z
Severity
  • 8.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
zstd-jni 1.1.1 through 1.5.7-13 Out-of-Bounds Read via Direct ByteBuffer Frame-Size Methods
Details

zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MIN_VALUE to read unmapped memory, causing JVM termination or extracting arbitrary frame size data from unintended memory locations.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-190"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87823.json"
}
References

Affected packages

Git / github.com/luben/zstd-jni

Affected ranges

Type
GIT
Repo
https://github.com/luben/zstd-jni
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
3216860eea289fbbae0b191c0a4fd8b72dad949c
Fixed
d7a1c99322d5e1fc71932e722c0b5bb2fc525d3f
Fixed
46dcb2a54c8b8f2ce2cad7187a7513f509c533ac
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "1.1.1"
                },
                {
                    "fixed":  "1.5.7-14"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "d7a1c99322d5e1fc71932e722c0b5bb2fc525d3f"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v1.5.7-14",
            "range":  [
                {
                    "fixed":  "3216860eea289fbbae0b191c0a4fd8b72dad949c"
                }
            ],
            "source":  "REFERENCES_TAG"
        },
        {
            "range":  [
                {
                    "fixed":  "46dcb2a54c8b8f2ce2cad7187a7513f509c533ac"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

1.*
1.4.4-4
b1.*
b1.5.5-9
c1.*
c1.5.2-5
v.*
v.1.3.8-9
v.1.5.5-5
v0.*
v0.1.1
v0.1.3
v0.2.1
v0.4.3
v0.4.4
v1.*
v1.2.0
v1.3.0-1
v1.3.1-1
v1.3.2-1
v1.3.2-2
v1.3.2-3
v1.3.3-1
v1.3.4-1
v1.3.4-10
v1.3.4-8
v1.3.5-1
v1.3.5-2
v1.3.5-3
v1.3.6-1
v1.3.7-1
v1.3.7-2
v1.3.7-3
v1.3.8-1
v1.3.8-2
v1.3.8-3
v1.3.8-4
v1.3.8-5
v1.3.8-6
v1.3.8-7
v1.3.8-8
v1.4.0-1
v1.4.1-1
v1.4.2-1
v1.4.3-1
v1.4.4-10
v1.4.4-11
v1.4.4-2
v1.4.4-3
v1.4.4-5
v1.4.4-7
v1.4.4-8
v1.4.4-9
v1.4.5-1
v1.4.5-10
v1.4.5-11
v1.4.5-12
v1.4.5-2
v1.4.5-3
v1.4.5-4
v1.4.5-6
v1.4.5-7
v1.4.5-8
v1.4.5-9
v1.4.7-1
v1.4.7-2
v1.4.7-3
v1.4.8-1
v1.4.8-2
v1.4.8-3
v1.4.8-4
v1.4.8-5
v1.4.8-6
v1.4.8-7
v1.4.9-1
v1.4.9-2
v1.4.9-3
v1.4.9-4
v1.4.9-5
v1.5.0-1
v1.5.0-2
v1.5.0-3
v1.5.0-4
v1.5.0-5
v1.5.1-1
v1.5.2-1
v1.5.2-2
v1.5.2-3
v1.5.4-1
v1.5.4-2
v1.5.5-1
v1.5.5-10
v1.5.5-11
v1.5.5-2
v1.5.5-3
v1.5.5-6
v1.5.5-7
v1.5.5-8
v1.5.5-9
v1.5.6-1
v1.5.6-10
v1.5.6-2
v1.5.6-3
v1.5.6-4
v1.5.6-5
v1.5.6-6
v1.5.6-7
v1.5.6-8
v1.5.6-9
v1.5.7-1
v1.5.7-11
v1.5.7-12
v1.5.7-13
v1.5.7-2
v1.5.7-3
v1.5.7-4
v1.5.7-5
v1.5.7-6
v1.5.7-7
v1.5.7-8
v1.5.7-9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-87823.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "146083951322912296939804979720762870854",
            "length":  447
        },
        "id":  "CVE-2026-87823-1d2f2b75",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/d7a1c99322d5e1fc71932e722c0b5bb2fc525d3f",
        "target":  {
            "file":  "src/main/native/jni_zstd.c",
            "function":  "Java_com_github_luben_zstd_Zstd_findDirectByteBufferFrameCompressedSize"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "162253780082402520808720351682869249421",
                "323843024591181548485509552756350390309",
                "240538329230256631968676926952743612326",
                "215555306911020366766884305543376778736",
                "49575097335770062467216995807625753016",
                "292255445078134060962298300881237020498",
                "314601416482173102382470614227336259059",
                "172053474565477640443700165289041992859",
                "49575097335770062467216995807625753016",
                "292255445078134060962298300881237020498",
                "314601416482173102382470614227336259059",
                "172053474565477640443700165289041992859"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-87823-1f39e2ae",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/d7a1c99322d5e1fc71932e722c0b5bb2fc525d3f",
        "target":  {
            "file":  "src/main/native/jni_zstd.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "193387029504870978956208265386345259651",
                "310566140824737737450243117982965054783",
                "232486976152496972105583249389444699619",
                "304120159565167350480955973624849771157",
                "61678452004531770531113105002945970698",
                "285615042445364367911379284556667744335",
                "244921086858118197602123485066485844103",
                "261606795590649099805705763823561846186",
                "102843108940604622962419936943173082421",
                "102470373365940861397621844871670975478",
                "202530041139225916796690383867977819383",
                "210189360840352522706140595738281560465",
                "61807314188310088165754390524416462563",
                "240478291574704788154369659441420955904"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-87823-2306ce7b",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/46dcb2a54c8b8f2ce2cad7187a7513f509c533ac",
        "target":  {
            "file":  "src/main/java/com/github/luben/zstd/Zstd.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "81449202969847413883654094864644827708",
                "261506033532509256078259245115562681722",
                "98883072272285932838247695169790093418",
                "2391325537968232174798058527407147646",
                "253691159677183346366636240936830076287",
                "329955055851287195660887282642533742112",
                "100834540177382872443313150250060059202",
                "6437101107169533246379962865789709874",
                "240029857680528361945114478257299686477"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-87823-44bbbf45",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/46dcb2a54c8b8f2ce2cad7187a7513f509c533ac",
        "target":  {
            "file":  "src/main/native/jni_zstd.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "319696483832917712384682231278816072707",
            "length":  525
        },
        "id":  "CVE-2026-87823-44dbbae1",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c",
        "target":  {
            "file":  "src/main/native/jni_zstd.c",
            "function":  "Java_com_github_luben_zstd_Zstd_getDirectByteBufferFrameContentSize"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "104759672726697835611132123038426386951",
            "length":  469
        },
        "id":  "CVE-2026-87823-7cf71bed",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/d7a1c99322d5e1fc71932e722c0b5bb2fc525d3f",
        "target":  {
            "file":  "src/main/native/jni_zstd.c",
            "function":  "Java_com_github_luben_zstd_Zstd_getDirectByteBufferFrameContentSize"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "16225920176429215584815173877467267743",
            "length":  496
        },
        "id":  "CVE-2026-87823-7f102d75",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/d7a1c99322d5e1fc71932e722c0b5bb2fc525d3f",
        "target":  {
            "file":  "src/main/native/jni_zstd.c",
            "function":  "Java_com_github_luben_zstd_Zstd_decompressedDirectByteBufferSize"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "242983979289756636978174893894911169283",
                "157823411836278810979700492519583258858",
                "47982388172284482667079231190836641912",
                "142002538935986523140505977783435642687",
                "70654406038950244899492554068964697791",
                "256841266079176367404669460587415964017",
                "136130365917502750732790875301653462261",
                "307914870517560413069750160813139035083",
                "70654406038950244899492554068964697791",
                "256841266079176367404669460587415964017",
                "136130365917502750732790875301653462261",
                "307914870517560413069750160813139035083"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-87823-cf1cd55a",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c",
        "target":  {
            "file":  "src/main/native/jni_zstd.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "6130561471615133004258603361745015963",
            "length":  503
        },
        "id":  "CVE-2026-87823-e402cad3",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c",
        "target":  {
            "file":  "src/main/native/jni_zstd.c",
            "function":  "Java_com_github_luben_zstd_Zstd_findDirectByteBufferFrameCompressedSize"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "243452810049814927721413726162029308560",
            "length":  552
        },
        "id":  "CVE-2026-87823-e43e017d",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c",
        "target":  {
            "file":  "src/main/native/jni_zstd.c",
            "function":  "Java_com_github_luben_zstd_Zstd_decompressedDirectByteBufferSize"
        }
    }
]
vanir_signatures_modified 
"2026-10-21T11:19:18Z"