CVE-2026-87824

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-87824
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-87824.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-87824
Aliases
  • GHSA-257p-3h6w-pg7h
Downstream
CLEANSTART (6)
DEBIAN (1)
openSUSE (1)
SUSE (2)
UBUNTU (1)
Related
openSUSE (1)
SUSE (2)
Published
2026-09-09T14:32:44Z
Modified
2026-10-21T11:19:16Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
zstd-jni 1.3.3-1 through 1.5.7-13 Out-of-Bounds Read via Zstd.trainFromBufferDirect
Details

zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect, allowing attackers to read past buffer boundaries by supplying oversized per-sample lengths. Attackers can trigger out-of-bounds memory access by providing crafted sample length arrays that cause the native implementation to walk past the buffer allocation, resulting in JVM termination.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-125"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87824.json"
}
References

Affected packages

Git / github.com/luben/zstd-jni

Affected ranges

Type
GIT
Repo
https://github.com/luben/zstd-jni
Events
Introduced
b7a712fa9c3f06a82b627ab8133a56fa96667f55
Fixed
3216860eea289fbbae0b191c0a4fd8b72dad949c
Fixed
bba6cfca2c0897f1fa004f4193247479f10da853
Fixed
53d3c6342883f7d6717b2477a7f9c1b4a4a56980
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "1.3.3-1"
                },
                {
                    "fixed":  "1.5.7-14"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "bba6cfca2c0897f1fa004f4193247479f10da853"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v1.5.7-14",
            "range":  [
                {
                    "fixed":  "3216860eea289fbbae0b191c0a4fd8b72dad949c"
                }
            ],
            "source":  "REFERENCES_TAG"
        },
        {
            "range":  [
                {
                    "fixed":  "53d3c6342883f7d6717b2477a7f9c1b4a4a56980"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

1.*
1.4.4-4
b1.*
b1.5.5-9
c1.*
c1.5.2-5
v.*
v.1.3.8-9
v.1.5.5-5
v1.*
v1.3.3-1
v1.3.4-1
v1.3.4-10
v1.3.4-8
v1.3.5-1
v1.3.5-2
v1.3.5-3
v1.3.6-1
v1.3.7-1
v1.3.7-2
v1.3.7-3
v1.3.8-1
v1.3.8-2
v1.3.8-3
v1.3.8-4
v1.3.8-5
v1.3.8-6
v1.3.8-7
v1.3.8-8
v1.4.0-1
v1.4.1-1
v1.4.2-1
v1.4.3-1
v1.4.4-10
v1.4.4-11
v1.4.4-2
v1.4.4-3
v1.4.4-5
v1.4.4-7
v1.4.4-8
v1.4.4-9
v1.4.5-1
v1.4.5-10
v1.4.5-11
v1.4.5-12
v1.4.5-2
v1.4.5-3
v1.4.5-4
v1.4.5-6
v1.4.5-7
v1.4.5-8
v1.4.5-9
v1.4.7-1
v1.4.7-2
v1.4.7-3
v1.4.8-1
v1.4.8-2
v1.4.8-3
v1.4.8-4
v1.4.8-5
v1.4.8-6
v1.4.8-7
v1.4.9-1
v1.4.9-2
v1.4.9-3
v1.4.9-4
v1.4.9-5
v1.5.0-1
v1.5.0-2
v1.5.0-3
v1.5.0-4
v1.5.0-5
v1.5.1-1
v1.5.2-1
v1.5.2-2
v1.5.2-3
v1.5.4-1
v1.5.4-2
v1.5.5-1
v1.5.5-10
v1.5.5-11
v1.5.5-2
v1.5.5-3
v1.5.5-6
v1.5.5-7
v1.5.5-8
v1.5.5-9
v1.5.6-1
v1.5.6-10
v1.5.6-2
v1.5.6-3
v1.5.6-4
v1.5.6-5
v1.5.6-6
v1.5.6-7
v1.5.6-8
v1.5.6-9
v1.5.7-1
v1.5.7-11
v1.5.7-12
v1.5.7-13
v1.5.7-2
v1.5.7-3
v1.5.7-4
v1.5.7-5
v1.5.7-6
v1.5.7-7
v1.5.7-8
v1.5.7-9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-87824.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "90687762287116442196021493034155010512",
            "length":  1267
        },
        "id":  "CVE-2026-87824-2fcb64bb",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/bba6cfca2c0897f1fa004f4193247479f10da853",
        "target":  {
            "file":  "src/main/native/jni_zdict.c",
            "function":  "Java_com_github_luben_zstd_Zstd_trainFromBufferDirect0"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "319696483832917712384682231278816072707",
            "length":  525
        },
        "id":  "CVE-2026-87824-44dbbae1",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c",
        "target":  {
            "file":  "src/main/native/jni_zstd.c",
            "function":  "Java_com_github_luben_zstd_Zstd_getDirectByteBufferFrameContentSize"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "39820095670622477516427803976239980636",
                "164652782768053360603732278326428041954",
                "96047713413161864598948063641006285726",
                "122348412375959061499699373065317441703",
                "307663675248418176845151262837642138882",
                "336339794259973993950502337978766649746",
                "43821606600911210354790601509234688605",
                "242573620071461085247637249342885826743",
                "84297515819000265450761929229647974391",
                "1365335079504060277035301373511267338",
                "135094583651782305687809386318704671840",
                "219315383155248253479184986927929755815",
                "215151702164266542235281961222017765393"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-87824-909fd96b",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/bba6cfca2c0897f1fa004f4193247479f10da853",
        "target":  {
            "file":  "src/main/native/jni_zdict.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "28260960913770257778388894868682223689",
                "217623153841788161132158587252771217541",
                "148850848430041229369457358306682510742"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-87824-a1b8d953",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/53d3c6342883f7d6717b2477a7f9c1b4a4a56980",
        "target":  {
            "file":  "src/main/java/com/github/luben/zstd/Zstd.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "242983979289756636978174893894911169283",
                "157823411836278810979700492519583258858",
                "47982388172284482667079231190836641912",
                "142002538935986523140505977783435642687",
                "70654406038950244899492554068964697791",
                "256841266079176367404669460587415964017",
                "136130365917502750732790875301653462261",
                "307914870517560413069750160813139035083",
                "70654406038950244899492554068964697791",
                "256841266079176367404669460587415964017",
                "136130365917502750732790875301653462261",
                "307914870517560413069750160813139035083"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-87824-cf1cd55a",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c",
        "target":  {
            "file":  "src/main/native/jni_zstd.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "6130561471615133004258603361745015963",
            "length":  503
        },
        "id":  "CVE-2026-87824-e402cad3",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c",
        "target":  {
            "file":  "src/main/native/jni_zstd.c",
            "function":  "Java_com_github_luben_zstd_Zstd_findDirectByteBufferFrameCompressedSize"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "243452810049814927721413726162029308560",
            "length":  552
        },
        "id":  "CVE-2026-87824-e43e017d",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c",
        "target":  {
            "file":  "src/main/native/jni_zstd.c",
            "function":  "Java_com_github_luben_zstd_Zstd_decompressedDirectByteBufferSize"
        }
    }
]
vanir_signatures_modified 
"2026-10-21T11:19:16Z"