CVE-2026-89046

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-89046
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89046.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-89046
Aliases
  • GHSA-rm53-6wf5-f34m
Downstream
Published
2026-09-10T17:39:35Z
Modified
2026-09-12T08:06:00Z
Severity
  • 8.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
zstd-jni 1.5.5-6 through 1.5.7-13 Out-of-Bounds Read via Negative Offset
Details

zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds read vulnerability in Zstd.getFrameContentSize that fails to validate negative srcPosition arguments. Attackers can supply negative offset values that bypass bounds checks and reach the native frame-header parser, causing out-of-bounds memory reads that lead to information disclosure or JVM crashes.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-125"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89046.json"
}
References

Affected packages

Git / github.com/luben/zstd-jni

Affected ranges

Type
GIT
Repo
https://github.com/luben/zstd-jni
Events
Introduced
92e7862b74112036a14359e184509875f310b32c
Fixed
3216860eea289fbbae0b191c0a4fd8b72dad949c
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "1.5.5-6"
        },
        {
            "fixed": "1.5.7-14"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

b1.*
b1.5.5-9
v1.*
v1.5.5-10
v1.5.5-11
v1.5.5-6
v1.5.5-7
v1.5.5-8
v1.5.5-9
v1.5.6-1
v1.5.6-10
v1.5.6-2
v1.5.6-3
v1.5.6-4
v1.5.6-5
v1.5.6-6
v1.5.6-7
v1.5.6-8
v1.5.6-9
v1.5.7-1
v1.5.7-11
v1.5.7-12
v1.5.7-13
v1.5.7-2
v1.5.7-3
v1.5.7-4
v1.5.7-5
v1.5.7-6
v1.5.7-7
v1.5.7-8
v1.5.7-9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89046.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "319696483832917712384682231278816072707",
            "length": 525
        },
        "id": "CVE-2026-89046-44dbbae1",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c",
        "target": {
            "file": "src/main/native/jni_zstd.c",
            "function": "Java_com_github_luben_zstd_Zstd_getDirectByteBufferFrameContentSize"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "242983979289756636978174893894911169283",
                "157823411836278810979700492519583258858",
                "47982388172284482667079231190836641912",
                "142002538935986523140505977783435642687",
                "70654406038950244899492554068964697791",
                "256841266079176367404669460587415964017",
                "136130365917502750732790875301653462261",
                "307914870517560413069750160813139035083",
                "70654406038950244899492554068964697791",
                "256841266079176367404669460587415964017",
                "136130365917502750732790875301653462261",
                "307914870517560413069750160813139035083"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-89046-cf1cd55a",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c",
        "target": {
            "file": "src/main/native/jni_zstd.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "6130561471615133004258603361745015963",
            "length": 503
        },
        "id": "CVE-2026-89046-e402cad3",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c",
        "target": {
            "file": "src/main/native/jni_zstd.c",
            "function": "Java_com_github_luben_zstd_Zstd_findDirectByteBufferFrameCompressedSize"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "243452810049814927721413726162029308560",
            "length": 552
        },
        "id": "CVE-2026-89046-e43e017d",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c",
        "target": {
            "file": "src/main/native/jni_zstd.c",
            "function": "Java_com_github_luben_zstd_Zstd_decompressedDirectByteBufferSize"
        }
    }
]
vanir_signatures_modified 
"2026-09-12T08:06:00Z"