Vulnerability · Published Sep 9, 2026 · Assigned by VulnCheck

CVE-2026-87825zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free of Compression and Decompression Dictionaries

High 7.7

In plain English

A high-severity use-after-free in zstd-jni from luben. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.7High

Exploit odds (30 days)0.2%top 88.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

zstd-jni before 1.5.7-14 contains a use-after-free vulnerability where streams and contexts hold a dictionary's shared lock only during the load call, allowing the dictionary to be closed while still referenced. Attackers can close a dictionary after associating it with a stream or context, causing subsequent read or write operations to access freed native memory, resulting in silent data corruption or JVM crashes.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	zstd-jni-java	no fix listed	DEBIAN-CVE-2026-87825
Debian:13	zstd-jni-java	no fix listed	DEBIAN-CVE-2026-87825
Debian:14	zstd-jni-java	1.5.7-23+ds-1	DEBIAN-CVE-2026-87825
Ubuntu:24.04:LTS	zstd-jni-java	no fix listed	UBUNTU-CVE-2026-87825
Ubuntu:26.04:LTS	zstd-jni-java	no fix listed	UBUNTU-CVE-2026-87825
Ubuntu:26.10	zstd-jni-java	no fix listed	UBUNTU-CVE-2026-87825

Affected products (as reported)

Vendor	Product	Versions
luben	zstd-jni	1.3.8-4 – before 1.5.7-14

Weakness: CWE-416 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

References

GitHub Security Advisory (GHSA-947w-pxjj-c7m9) vendor-advisory
Fix commit: hold the dictionary shared lock for the stream's usage window patch
Fix commit: cross-object lifetime tracking for dictionaries and contexts patch
Shared lock released as soon as the dictionary is loaded at v1.5.7-13 technical-description
Same lock lifecycle in the buffer stream base class at v1.5.7-13 technical-description
zstd-jni v1.5.7-14 Release Notes release-notes
Commit that made setDict load the dictionary eagerly into the native context (first released in 1.3.8-4) technical-description, patch
https://github.com/luben/zstd-jni product
VulnCheck Advisory: zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free of Compression and Decompression Dictionaries third-party-advisory