CVE-2026-89046 PUBLISHED

zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds read vulnerability in Zstd.getFrameContentSize that fails to validate negative srcPosition arguments. Attackers can supply negative offset values that bypass bounds checks and reach the native frame-header parser, causing out-of-bounds memory reads that lead to information disclosure or JVM crashes.

• Yu Bao, PayPal Cyber Security Team finder

• GitHub Security Advisory (GHSA-rm53-6wf5-f34m)
• Fix commit: reject a negative source position and size
• Upper-bound-only bounds check at v1.5.7-13
• Native routine that offsets the critical array pointer without re-validating
• zstd-jni v1.5.7-14 Release Notes
• luben/zstd-jni
• VulnCheck Advisory: zstd-jni 1.5.5-6 through 1.5.7-13 Out-of-Bounds Read via Negative Offset

• Out-of-bounds Read CWE