Description

zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect, allowing attackers to read past buffer boundaries by supplying oversized per-sample lengths. Attackers can trigger out-of-bounds memory access by providing crafted sample length arrays that cause the native implementation to walk past the buffer allocation, resulting in JVM termination.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-09T15:17:27.753Z",
  "pubdate": "2026-09-09T15:17:27.753Z",
  "executiveSummary": "The zstd-jni library, in versions prior to 1.5.7-14, contains a critical memory safety vulnerability originating from insufficient input validation. This flaw is classified as an out-of-bounds (OOB) memory access vulnerability located within the native layer of the JNI (Java Native Interface) implementation.\nThe vulnerability occurs specifically within the Zstd.trainFromBufferDirect function, where the logic fails to enforce strict bounds checking on the samples buffer capacity. An attacker capable of influencing the sample length parameters provided to this function can trigger an out-of-bounds read.\nThis vulnerability poses a significant risk to JVM stability and data integrity. By supplying a maliciously crafted array of sample lengths, an attacker can force the native Zstd implementation to perform memory access operations beyond the allocated boundaries of the buffer.\nThe primary impact of successful exploitation is the immediate termination of the JVM, leading to a denial-of-service (DoS) condition. While primary exploitation triggers a crash, such memory access primitives often have the potential for information disclosure or further exploitation depending on the environment, though the current threat is identified as service disruption. Exploitation requires the attacker to control input parameters passed to the vulnerable JNI function.",
  "technicalDetails": "The root cause of this vulnerability lies in a lack of boundary validation within the native implementation of Zstd.trainFromBufferDirect. The function is designed to handle sample buffers for Zstandard dictionary training; however, the JNI layer fails to verify that the specified per-sample lengths correspond accurately to the memory allocated in the provided samples buffer.\nWhen Zstd.trainFromBufferDirect is invoked, the native layer processes an array containing the lengths of individual samples. If an attacker provides a crafted array where the specified lengths exceed the actual data available in the underlying buffer, the native code proceeds to process memory addresses beyond the intended scope of the input buffer.\nThe attack flow proceeds as follows: First, the attacker identifies an entry point where application input controls the sample length data passed to the Zstd.trainFromBufferDirect method. Second, the attacker constructs a malicious payload consisting of an array of sample lengths that aggregate to a value greater than the allocated buffer size. Third, upon execution, the native Zstd code iterates through these samples, relying on the attacker-controlled length metadata. Because the validation logic is missing, the native pointer arithmetic traverses into adjacent memory segments.\nThe resulting out-of-bounds memory access leads to an illegal memory read operation within the native process space. Because this occurs within the JNI layer, the underlying C/C++ memory violation is propagated to the JVM, which cannot safely handle the fault, ultimately resulting in an unrecoverable crash and JVM termination.\nThis vulnerability is present in versions of zstd-jni before 1.5.7-14. It requires no specific authentication, but it does require that the attacker has the ability to submit data that is eventually processed by the library. The impact is primarily restricted to local denial-of-service, as the JVM crash effectively halts all services currently running within that specific virtual machine instance."
}