Description

zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MIN_VALUE to read unmapped memory, causing JVM termination or extracting arbitrary frame size data from unintended memory locations.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-09-09T15:17:27.583Z",
  "pubdate": "2026-09-09T15:17:27.583Z",
  "executiveSummary": "The zstd-jni library contains a critical memory safety vulnerability involving improper bounds validation within its native ByteBuffer processing methods.\nThe vulnerability is classified as an out-of-bounds (OOB) memory read, which arises due to the use of signed 32-bit integer arithmetic when validating offsets provided for direct-ByteBuffer operations.\nAffected versions include all zstd-jni releases prior to 1.5.7-14.\nAn attacker can supply malicious negative or overflowing offset values to these native methods, bypassing security checks and accessing unintended memory addresses.\nThe primary risk involves the potential for arbitrary memory disclosure, which could leak sensitive information from the JVM process space, or cause a denial-of-service condition through segmentation faults or unmapped memory access, leading to immediate JVM termination.\nThis vulnerability does not require authentication or elevated privileges, provided the attacker can influence the input arguments passed to the vulnerable Java native interface (JNI) methods.",
  "technicalDetails": "The vulnerability resides within the native implementation of three specific methods responsible for calculating frame sizes when interacting with direct-ByteBuffers. The root cause is the failure to enforce strict unsigned bounds validation for input offsets, specifically when the input is treated as a signed 32-bit integer.\nIn the affected versions of zstd-jni, the underlying JNI code performs calculations on offset values without checking for negative inputs or values that overflow the maximum capacity of the buffer. By passing carefully crafted values—specifically those proximal to Integer.MIN_VALUE—an attacker can induce an integer underflow or overflow condition during the pointer arithmetic performed in C/C++.\nWhen these negative offsets are used to index into the memory segment associated with the direct-ByteBuffer, the native pointer arithmetic results in a memory address outside the bounds of the allocated buffer. Because the JVM heap and the process's native address space are accessible to the native code, this pointer manipulation allows the code to perform read operations on memory locations that are logically disconnected from the intended data structure.\nThe attack flow follows a predictable sequence: First, the attacker identifies a JVM application that utilizes zstd-jni to process untrusted frame data. Second, the attacker crafts a malicious input payload containing a negative offset value targeting the vulnerable frame-size methods. Third, the JNI layer receives this offset and, due to insufficient validation, uses it to calculate a target address. Fourth, the native zstd-jni library executes a read operation on the calculated target memory. If the calculated address resides in unmapped memory, the process encounters a memory access violation, forcing the JVM to terminate and creating a denial-of-service. If the address points to valid, mapped memory belonging to the application process, the native method may return arbitrary data from that location, leading to sensitive information disclosure.\nThe impact is severe because it circumvents the memory safety guarantees typically provided by the Java runtime, effectively turning the native component into an oracle for arbitrary process memory or a trigger for application crashes."
}