Description

zstd-jni before 1.5.7-14 contains a use-after-free vulnerability where streams and contexts hold a dictionary's shared lock only during the load call, allowing the dictionary to be closed while still referenced. Attackers can close a dictionary after associating it with a stream or context, causing subsequent read or write operations to access freed native memory, resulting in silent data corruption or JVM crashes.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-09-09T15:17:27.903Z",
  "pubdate": "2026-09-09T15:17:27.903Z",
  "executiveSummary": "A critical use-after-free vulnerability exists in zstd-jni prior to version 1.5.7-14, stemming from improper lifecycle management of dictionary resources within the native layer.\nThe vulnerability allows an attacker to trigger the closure of a Zstd dictionary while it remains associated with an active stream or context.\nThis leads to a race condition where subsequent native operations attempt to access memory that has been deallocated, resulting in memory corruption or arbitrary JVM process crashes.\nThe flaw affects all zstd-jni deployments utilizing custom dictionary loading for stream or context compression/decompression tasks.\nExploitation requires the attacker to have sufficient control over the application's dictionary or stream management logic to initiate the premature closure of the shared resource.\nThe impact is significant, as it can lead to silent data corruption, destabilization of the Java Virtual Machine, or potential remote code execution pathways if memory layout can be manipulated during the heap reuse phase.",
  "technicalDetails": "The root cause of this vulnerability lies in the concurrency control logic implemented for Zstd dictionary handles within the zstd-jni native interface. Specifically, the synchronization mechanism only enforces a shared lock during the initial load call of the dictionary into a stream or context. Once the load operation concludes, the lock is released, and the reference management between the higher-level Java objects and the underlying native memory becomes disconnected.\nIn the affected versions, the native component fails to maintain a reference count or an active lock on the dictionary resource throughout the entire duration of the stream's or context's lifecycle. Consequently, if a separate thread invokes a 'close' or 'dispose' operation on the dictionary object, the native pointer associated with that dictionary is freed from the heap.\nThe attack flow follows a precise sequence: 1) An attacker initializes a compression or decompression stream using a specific Zstd dictionary. 2) The attacker then triggers a secondary, concurrent operation that explicitly requests the closure of said dictionary object. 3) Because the dictionary lacks persistent state validation after the load call, the JNI wrapper proceeds to deallocate the associated memory. 4) The original stream or context, which remains in a 'live' state, attempts to perform a read or write operation using the stale native pointer to the freed dictionary memory. 5) This results in a use-after-free condition where the native code reads from or writes to memory that may have already been reclaimed or overwritten by other allocations.\nThe technical fallout is severe due to the nature of Zstd's native memory management. If an attacker successfully fills the recently freed memory area with controlled data before the stream attempts to access the stale pointer, they may influence the compression/decompression logic, leading to controlled data corruption. In most common scenarios, the access to deallocated memory triggers an immediate segmentation fault, leading to a JVM-wide crash, effectively enabling a Denial of Service (DoS) attack. Because this occurs within the JNI boundary, standard Java-level memory safety protections are bypassed, making the vulnerability a high-priority concern for applications relying on Zstd for high-throughput data processing."
}