CVE-2026-87825

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-87825
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-87825.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-87825
Aliases
  • GHSA-947w-pxjj-c7m9
Downstream
Published
2026-09-09T14:32:44Z
Modified
2026-09-10T08:13:49Z
Severity
  • 7.0 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free of Compression and Decompression Dictionaries
Details

zstd-jni before 1.5.7-14 contains a use-after-free vulnerability where streams and contexts hold a dictionary's shared lock only during the load call, allowing the dictionary to be closed while still referenced. Attackers can close a dictionary after associating it with a stream or context, causing subsequent read or write operations to access freed native memory, resulting in silent data corruption or JVM crashes.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-416"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87825.json"
}
References

Affected packages

Git / github.com/luben/zstd-jni

Affected ranges

Type
GIT
Repo
https://github.com/luben/zstd-jni
Events
Introduced
0830536d204f2944f4a124517aec80b5e5dc2647
Fixed
3216860eea289fbbae0b191c0a4fd8b72dad949c
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "1.3.8-4"
        },
        {
            "fixed": "1.5.7-14"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*
1.4.4-4
b1.*
b1.5.5-9
c1.*
c1.5.2-5
v.*
v.1.3.8-9
v.1.5.5-5
v1.*
v1.3.8-4
v1.3.8-5
v1.3.8-6
v1.3.8-7
v1.3.8-8
v1.4.0-1
v1.4.1-1
v1.4.2-1
v1.4.3-1
v1.4.4-10
v1.4.4-11
v1.4.4-2
v1.4.4-3
v1.4.4-5
v1.4.4-7
v1.4.4-8
v1.4.4-9
v1.4.5-1
v1.4.5-10
v1.4.5-11
v1.4.5-12
v1.4.5-2
v1.4.5-3
v1.4.5-4
v1.4.5-6
v1.4.5-7
v1.4.5-8
v1.4.5-9
v1.4.7-1
v1.4.7-2
v1.4.7-3
v1.4.8-1
v1.4.8-2
v1.4.8-3
v1.4.8-4
v1.4.8-5
v1.4.8-6
v1.4.8-7
v1.4.9-1
v1.4.9-2
v1.4.9-3
v1.4.9-4
v1.4.9-5
v1.5.0-1
v1.5.0-2
v1.5.0-3
v1.5.0-4
v1.5.0-5
v1.5.1-1
v1.5.2-1
v1.5.2-2
v1.5.2-3
v1.5.4-1
v1.5.4-2
v1.5.5-1
v1.5.5-10
v1.5.5-11
v1.5.5-2
v1.5.5-3
v1.5.5-6
v1.5.5-7
v1.5.5-8
v1.5.5-9
v1.5.6-1
v1.5.6-10
v1.5.6-2
v1.5.6-3
v1.5.6-4
v1.5.6-5
v1.5.6-6
v1.5.6-7
v1.5.6-8
v1.5.6-9
v1.5.7-1
v1.5.7-11
v1.5.7-12
v1.5.7-13
v1.5.7-2
v1.5.7-3
v1.5.7-4
v1.5.7-5
v1.5.7-6
v1.5.7-7
v1.5.7-8
v1.5.7-9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-87825.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "319696483832917712384682231278816072707",
            "length": 525
        },
        "id": "CVE-2026-87825-44dbbae1",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c",
        "target": {
            "file": "src/main/native/jni_zstd.c",
            "function": "Java_com_github_luben_zstd_Zstd_getDirectByteBufferFrameContentSize"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "242983979289756636978174893894911169283",
                "157823411836278810979700492519583258858",
                "47982388172284482667079231190836641912",
                "142002538935986523140505977783435642687",
                "70654406038950244899492554068964697791",
                "256841266079176367404669460587415964017",
                "136130365917502750732790875301653462261",
                "307914870517560413069750160813139035083",
                "70654406038950244899492554068964697791",
                "256841266079176367404669460587415964017",
                "136130365917502750732790875301653462261",
                "307914870517560413069750160813139035083"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-87825-cf1cd55a",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c",
        "target": {
            "file": "src/main/native/jni_zstd.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "6130561471615133004258603361745015963",
            "length": 503
        },
        "id": "CVE-2026-87825-e402cad3",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c",
        "target": {
            "file": "src/main/native/jni_zstd.c",
            "function": "Java_com_github_luben_zstd_Zstd_findDirectByteBufferFrameCompressedSize"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "243452810049814927721413726162029308560",
            "length": 552
        },
        "id": "CVE-2026-87825-e43e017d",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c",
        "target": {
            "file": "src/main/native/jni_zstd.c",
            "function": "Java_com_github_luben_zstd_Zstd_decompressedDirectByteBufferSize"
        }
    }
]
vanir_signatures_modified 
"2026-09-10T08:13:49Z"