{"id":"CVE-2026-87823","summary":"zstd-jni 1.1.1 through 1.5.7-13 Out-of-Bounds Read via Direct ByteBuffer Frame-Size Methods","details":"zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MIN_VALUE to read unmapped memory, causing JVM termination or extracting arbitrary frame size data from unintended memory locations.","aliases":["GHSA-jfr6-9xqw-2g2q"],"modified":"2026-10-28T11:19:06.224716500Z","published":"2026-09-09T14:32:43.442Z","related":["SUSE-SU-2026:23858-1","SUSE-SU-2026:23868-1","openSUSE-SU-2026:11769-1","openSUSE-SU-2026:21902-1"],"database_specific":{"cwe_ids":["CWE-190"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87823.json","cna_assigner":"VulnCheck"},"references":[{"type":"WEB","url":"https://repo1.maven.org/maven2/com/github/luben/zstd-jni/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87823.json"},{"type":"ADVISORY","url":"https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"},{"type":"ADVISORY","url":"https://github.com/luben/zstd-jni/security/advisories/GHSA-jfr6-9xqw-2g2q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87823"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/zstd-jni-1.1.1-through-1.5.7-13-out-of-bounds-read-via-direct-bytebuffer-frame-size-methods"},{"type":"FIX","url":"https://github.com/luben/zstd-jni/commit/46dcb2a54c8b8f2ce2cad7187a7513f509c533ac"},{"type":"FIX","url":"https://github.com/luben/zstd-jni/commit/d7a1c99322d5e1fc71932e722c0b5bb2fc525d3f"},{"type":"PACKAGE","url":"https://github.com/luben/zstd-jni"},{"type":"ARTICLE","url":"https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/Zstd.java"},{"type":"ARTICLE","url":"https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_zstd.c"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/luben/zstd-jni","events":[{"introduced":"0"},{"fixed":"3216860eea289fbbae0b191c0a4fd8b72dad949c"},{"fixed":"d7a1c99322d5e1fc71932e722c0b5bb2fc525d3f"},{"fixed":"46dcb2a54c8b8f2ce2cad7187a7513f509c533ac"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"1.1.1"},{"fixed":"1.5.7-14"}]},{"source":"REFERENCES_COMMIT","range":[{"fixed":"d7a1c99322d5e1fc71932e722c0b5bb2fc525d3f"}]},{"range":[{"fixed":"3216860eea289fbbae0b191c0a4fd8b72dad949c"}],"source":"REFERENCES_TAG","original_tag":"v1.5.7-14"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"46dcb2a54c8b8f2ce2cad7187a7513f509c533ac"}]}]}}],"versions":["v1.5.7-13","v1.5.7-12","v1.5.7-11","v1.5.7-9","v1.5.7-8","v1.5.7-7","v1.5.7-6","v1.5.7-5","v1.5.7-4","v1.5.7-3","v1.5.7-2","v1.5.7-1","v1.5.6-10","v1.5.6-9","v1.5.6-8","v1.5.6-7","v1.5.6-6","v1.5.6-5","v1.5.6-4","v1.5.6-3","v1.5.6-2","v1.5.6-1","v1.5.5-11","v1.5.5-10","v1.5.5-9","b1.5.5-9","v1.5.5-8","v1.5.5-7","v1.5.5-6","v.1.5.5-5","v1.5.5-3","v1.5.5-2","v1.5.5-1","v1.5.4-2","v1.5.4-1","c1.5.2-5","v1.5.2-3","v1.5.2-2","v1.5.2-1","v1.5.1-1","v1.5.0-5","v1.5.0-4","v1.5.0-3","v1.5.0-2","v1.5.0-1","v1.4.9-5","v1.4.9-4","v1.4.9-3","v1.4.9-2","v1.4.9-1","v1.4.8-7","v1.4.8-6","v1.4.8-5","v1.4.8-4","v1.4.8-3","v1.4.8-2","v1.4.8-1","v1.4.7-3","v1.4.7-2","v1.4.7-1","v1.4.5-12","v1.4.5-11","v1.4.5-10","v1.4.5-9","v1.4.5-8","v1.4.5-7","v1.4.5-6","v1.4.5-4","v1.4.5-3","v1.4.5-2","v1.4.5-1","v1.4.4-11","v1.4.4-10","v1.4.4-9","v1.4.4-8","v1.4.4-7","v1.4.4-5","1.4.4-4","v1.4.4-3","v1.4.4-2","v1.4.3-1","v1.4.2-1","v1.4.1-1","v1.4.0-1","v.1.3.8-9","v1.3.8-8","v1.3.8-7","v1.3.8-6","v1.3.8-5","v1.3.8-4","v1.3.8-3","v1.3.8-2","v1.3.8-1","v1.3.7-3","v1.3.7-2","v1.3.7-1","v1.3.6-1","v1.3.5-3","v1.3.5-2","v1.3.5-1","v1.3.4-10","v1.3.4-8","v1.3.4-1","v1.3.3-1","v1.3.2-3","v1.3.2-2","v1.3.2-1","v1.3.1-1","v1.3.0-1","v1.2.0","v0.4.4","v0.4.3","v0.2.1","v0.1.3","v0.1.1"],"database_specific":{"vanir_signatures":[{"source":"https://github.com/luben/zstd-jni/commit/d7a1c99322d5e1fc71932e722c0b5bb2fc525d3f","target":{"file":"src/main/native/jni_zstd.c","function":"Java_com_github_luben_zstd_Zstd_findDirectByteBufferFrameCompressedSize"},"deprecated":false,"digest":{"length":447,"function_hash":"146083951322912296939804979720762870854"},"id":"CVE-2026-87823-1d2f2b75","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/luben/zstd-jni/commit/d7a1c99322d5e1fc71932e722c0b5bb2fc525d3f","target":{"file":"src/main/native/jni_zstd.c"},"deprecated":false,"digest":{"line_hashes":["162253780082402520808720351682869249421","323843024591181548485509552756350390309","240538329230256631968676926952743612326","215555306911020366766884305543376778736","49575097335770062467216995807625753016","292255445078134060962298300881237020498","314601416482173102382470614227336259059","172053474565477640443700165289041992859","49575097335770062467216995807625753016","292255445078134060962298300881237020498","314601416482173102382470614227336259059","172053474565477640443700165289041992859"],"threshold":0.9},"id":"CVE-2026-87823-1f39e2ae","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/46dcb2a54c8b8f2ce2cad7187a7513f509c533ac","target":{"file":"src/main/java/com/github/luben/zstd/Zstd.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["193387029504870978956208265386345259651","310566140824737737450243117982965054783","232486976152496972105583249389444699619","304120159565167350480955973624849771157","61678452004531770531113105002945970698","285615042445364367911379284556667744335","244921086858118197602123485066485844103","261606795590649099805705763823561846186","102843108940604622962419936943173082421","102470373365940861397621844871670975478","202530041139225916796690383867977819383","210189360840352522706140595738281560465","61807314188310088165754390524416462563","240478291574704788154369659441420955904"]},"id":"CVE-2026-87823-2306ce7b","signature_type":"Line"},{"id":"CVE-2026-87823-44bbbf45","signature_type":"Line","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/46dcb2a54c8b8f2ce2cad7187a7513f509c533ac","target":{"file":"src/main/native/jni_zstd.c"},"deprecated":false,"digest":{"line_hashes":["81449202969847413883654094864644827708","261506033532509256078259245115562681722","98883072272285932838247695169790093418","2391325537968232174798058527407147646","253691159677183346366636240936830076287","329955055851287195660887282642533742112","100834540177382872443313150250060059202","6437101107169533246379962865789709874","240029857680528361945114478257299686477"],"threshold":0.9}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c","target":{"file":"src/main/native/jni_zstd.c","function":"Java_com_github_luben_zstd_Zstd_getDirectByteBufferFrameContentSize"},"deprecated":false,"digest":{"length":525,"function_hash":"319696483832917712384682231278816072707"},"id":"CVE-2026-87823-44dbbae1"},{"signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/d7a1c99322d5e1fc71932e722c0b5bb2fc525d3f","target":{"file":"src/main/native/jni_zstd.c","function":"Java_com_github_luben_zstd_Zstd_getDirectByteBufferFrameContentSize"},"deprecated":false,"digest":{"function_hash":"104759672726697835611132123038426386951","length":469},"id":"CVE-2026-87823-7cf71bed","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/d7a1c99322d5e1fc71932e722c0b5bb2fc525d3f","target":{"function":"Java_com_github_luben_zstd_Zstd_decompressedDirectByteBufferSize","file":"src/main/native/jni_zstd.c"},"deprecated":false,"digest":{"length":496,"function_hash":"16225920176429215584815173877467267743"},"id":"CVE-2026-87823-7f102d75","signature_type":"Function"},{"id":"CVE-2026-87823-cf1cd55a","signature_type":"Line","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c","target":{"file":"src/main/native/jni_zstd.c"},"deprecated":false,"digest":{"line_hashes":["242983979289756636978174893894911169283","157823411836278810979700492519583258858","47982388172284482667079231190836641912","142002538935986523140505977783435642687","70654406038950244899492554068964697791","256841266079176367404669460587415964017","136130365917502750732790875301653462261","307914870517560413069750160813139035083","70654406038950244899492554068964697791","256841266079176367404669460587415964017","136130365917502750732790875301653462261","307914870517560413069750160813139035083"],"threshold":0.9}},{"digest":{"function_hash":"6130561471615133004258603361745015963","length":503},"id":"CVE-2026-87823-e402cad3","signature_type":"Function","signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c","target":{"function":"Java_com_github_luben_zstd_Zstd_findDirectByteBufferFrameCompressedSize","file":"src/main/native/jni_zstd.c"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/luben/zstd-jni/commit/3216860eea289fbbae0b191c0a4fd8b72dad949c","target":{"file":"src/main/native/jni_zstd.c","function":"Java_com_github_luben_zstd_Zstd_decompressedDirectByteBufferSize"},"deprecated":false,"digest":{"function_hash":"243452810049814927721413726162029308560","length":552},"id":"CVE-2026-87823-e43e017d","signature_type":"Function"}],"vanir_signatures_modified":"2026-10-28T11:19:06Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-87823.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"}]}