Description

zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read vulnerability in the ZstdDictDecompress constructor because offset and length arguments are never validated against the dictionary array bounds. Attackers can supply arbitrary offset or length values to read memory past the end of the supplied array, potentially causing JVM termination.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-09-12T18:16:44.890Z",
  "pubdate": "2026-09-12T18:16:44.890Z",
  "executiveSummary": "The zstd-jni library is susceptible to an out-of-bounds (OOB) read vulnerability within the ZstdDictDecompress constructor. This flaw arises from a critical lack of input validation regarding offset and length arguments provided to the dictionary array. By passing crafted parameters, an attacker can coerce the library into accessing memory addresses outside the intended buffer boundaries. The primary impact of this vulnerability is the potential for arbitrary memory access and JVM process termination, leading to a denial-of-service (DoS) condition. Affected versions range from 1.2.0 through 1.5.7-13. The vulnerability poses a significant risk to applications relying on zstd-jni for dictionary-based decompression, as it allows unauthenticated attackers to disrupt service availability. No specific network-level privilege is required, provided the attacker can influence the inputs consumed by the vulnerable constructor.",
  "technicalDetails": "The root cause of this vulnerability lies in the ZstdDictDecompress constructor within the zstd-jni package, which fails to perform bounds checking on the offset and length parameters provided for the dictionary byte array. In the context of the Java Native Interface (JNI), this creates a security gap where the Java-side inputs are passed to native code without verification against the allocated memory buffer size.\nThe exploitation flow initiates when an attacker triggers the invocation of the ZstdDictDecompress constructor, supplying malicious 'offset' and 'length' values. Because these arguments are not validated against the length of the underlying byte array, the library attempts to read or access memory regions beyond the buffer's designated bounds. When the native Zstd implementation attempts to process this data, it performs pointer arithmetic based on the attacker-supplied values, resulting in an OOB read operation.\nThe lack of bounds validation leads to two main outcomes. First, the attempt to read unallocated or invalid memory locations typically triggers a segmentation fault or an access violation at the native layer. Given the architecture of the Java Virtual Machine (JVM), such native-level memory corruption cannot be caught by standard Java exception handling, resulting in the immediate and ungraceful termination of the JVM process.\nSecond, the ability to specify arbitrary offsets provides a primitive for reading sensitive data residing in contiguous memory, although the immediate impact documented is system instability. Because the constructor is accessible via the library's public API, any application utilizing zstd-jni to process dictionary files from untrusted or external sources is exposed. No specific authentication is required if the vulnerable code path is reachable through user-supplied input or configuration files. The vulnerability affects all versions of zstd-jni from 1.2.0 up to and including 1.5.7-13. The persistence of this issue across versions highlights a systemic failure to enforce boundary constraints on native buffer interactions, necessitating strict input validation before passing parameters to the constructor."
}