CVE-2026-87824 PUBLISHED

zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect, allowing attackers to read past buffer boundaries by supplying oversized per-sample lengths. Attackers can trigger out-of-bounds memory access by providing crafted sample length arrays that cause the native implementation to walk past the buffer allocation, resulting in JVM termination.

• Yu Bao, PayPal Cyber Security Team finder

• GitHub Security Advisory (GHSA-257p-3h6w-pg7h)
• Fix commit: validate the samples buffer capacity against the declared sample sizes
• Samples buffer capacity never read at v1.5.7-13
• Java wrapper that only checks the sample count at v1.5.7-13
• zstd-jni v1.5.7-14 Release Notes
• Commit that introduced the direct-buffer dictionary trainer without a samples capacity check (first released in 1.3.3-1)
• https://github.com/luben/zstd-jni
• VulnCheck Advisory: zstd-jni 1.3.3-1 through 1.5.7-13 Out-of-Bounds Read via Zstd.trainFromBufferDirect

• Out-of-bounds Read CWE