Description

zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-09-09T15:17:28.070Z",
  "pubdate": "2026-09-09T15:17:28.070Z",
  "executiveSummary": "The zstd-jni library is susceptible to a use-after-free vulnerability stemming from insufficient state validation in its JNI (Java Native Interface) stream classes. Versions prior to 1.5.7-14 fail to verify whether a stream has been closed before executing configuration methods, including setDict, setLongMax, setLevel, and setRefMultipleDDicts.\nThis flaw allows an attacker to trigger operations on native pointers that have already been deallocated by the JVM's garbage collection or explicit close methods. The primary impact is memory corruption within the native heap, which can lead to arbitrary memory access, application crashes, or potential remote code execution by hijacking control flow through the corruption of adjacent native objects.\nThe vulnerability affects all users of zstd-jni versions below 1.5.7-14. Exploitation does not require special authentication but depends on the application's ability to handle user-supplied input that interacts with stream lifecycle management. The risk is significant for high-performance applications relying on zstd compression, as a successful exploit could compromise the integrity of the JVM's underlying native runtime environment.",
  "technicalDetails": "The vulnerability resides within the native-to-Java bridge of the zstd-jni library, specifically in how the JNI wrapper manages the lifecycle of the underlying Zstandard compression contexts. The Java stream classes maintain a reference to a native memory address representing the C-based Zstd structure. Upon invocation of close() or equivalent teardown routines, the native memory is freed; however, the Java wrapper fails to set the pointer to null or perform a 'closed' state check in specific configuration methods.\nThe vulnerable methods—setDict, setLongMax, setLevel, and setRefMultipleDDicts—operate directly on these stale native pointers. When an attacker invokes these methods after the stream has been closed, the JNI layer attempts to perform pointer arithmetic or write operations at the memory address previously occupied by the Zstd context. Because the memory has been returned to the allocator, it may have been reallocated for other objects by the system heap.\nThe exploitation flow is as follows: 1) An attacker forces an application to initialize and subsequently close a zstd-jni stream. 2) The attacker triggers a sequence of memory allocations to fill the freed slot with controlled data (Heap Spraying/Grooming). 3) The attacker invokes one of the vulnerable methods on the stale object. 4) The JNI method writes to the now-occupied memory, corrupting the new object or modifying pointers within the heap.\nThis vulnerability is particularly dangerous because it bypasses standard JVM memory safety guarantees. Since the corruption occurs in native memory outside the control of the JVM's garbage collector, the attacker can manipulate internal structure data (such as vtables or object metadata), potentially leading to arbitrary code execution if the corrupted heap area is later used to execute a function call or jump to a redirected instruction pointer.\nAffected versions are all releases prior to 1.5.7-14. There are no explicit authentication requirements, as the attack is performed through the logical interaction with the library's exposed API. The technical root cause is the lack of a 'closed' flag or synchronization mechanism that enforces thread-safe validation of the native pointer state before any JNI-based native method execution."
}