zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()
Summary
| CVE | CVE-2026-87877 |
|---|---|
| State | PUBLISHED |
| Assigner | VulnCheck |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-09-09 15:17:28 UTC |
| Updated | 2026-09-09 20:16:54 UTC |
| Description | zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM. |
Risk And Classification
Primary CVSS: v4.0 7 HIGH from [email protected]
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS: 0.002010000 probability, percentile 0.100930000 (date 2026-09-10)
Problem Types: CWE-416 | CWE-416 Use After Free
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 7 | HIGH | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 7 | HIGH | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N |
| 3.1 | [email protected] | Secondary | 7.7 | HIGH | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
| 3.1 | CNA | CVSS | 7.7 | HIGH | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
CVSS v4.0 Breakdown
Attack Vector
LocalAttack Complexity
LowAttack Requirements
NonePrivileges Required
NoneUser Interaction
NoneConfidentiality
NoneIntegrity
HighAvailability
HighSub Conf.
NoneSub Integrity
NoneSub Availability
NoneCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 Breakdown
Attack Vector
LocalAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
NoneIntegrity
HighAvailability
HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.vulncheck.com/advisories/zstd-jni-1.3.8-4-through-1.5.7-13-use-after-free-v... | [email protected] | www.vulncheck.com | |
| github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555 | [email protected] | github.com | |
| github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/... | [email protected] | github.com | |
| github.com/luben/zstd-jni/security/advisories/GHSA-2jw3-mg7f-vw4q | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | github.com | |
| github.com/luben/zstd-jni/releases/tag/v1.5.7-14 | [email protected] | github.com | |
| github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/... | [email protected] | github.com | |
| github.com/luben/zstd-jni | [email protected] | github.com | |
| github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938 | [email protected] | github.com | |
| github.com/luben/zstd-jni/commit/f38f9a1563113d96d0fc38baee543f7457dd8a8e | [email protected] | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Yu Bao, PayPal Cyber Security Team (en)
There are currently no legacy QID mappings associated with this CVE.