CVE-2026-87823 PUBLISHED

zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MIN_VALUE to read unmapped memory, causing JVM termination or extracting arbitrary frame size data from unintended memory locations.

• Yu Bao, PayPal Cyber Security Team finder

• GitHub Security Advisory (GHSA-jfr6-9xqw-2g2q)
• Fix commit: reject negative offset and size in the three direct-ByteBuffer natives
• Unchecked 32-bit bounds tests at v1.5.7-13
• Native declarations with no Java-side validation at v1.5.7-13
• zstd-jni v1.5.7-14 Release Notes
• Commit that introduced the unchecked direct-ByteBuffer size natives (first released in 1.1.1)
• https://github.com/luben/zstd-jni
• VulnCheck Advisory: zstd-jni 1.1.1 through 1.5.7-13 Out-of-Bounds Read via Direct ByteBuffer Frame-Size Methods

• Integer Overflow or Wraparound CWE