Vulnerability · Published Sep 9, 2026 · Assigned by VulnCheck
CVE-2026-87877zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()
High 7.7
In plain English
A high-severity use-after-free in zstd-jni from luben. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.7High
Exploit odds (30 days)0.2%top 87.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | zstd-jni-java | no fix listed | DEBIAN-CVE-2026-87877 |
| Debian:13 | zstd-jni-java | no fix listed | DEBIAN-CVE-2026-87877 |
| Debian:14 | zstd-jni-java | 1.5.7-23+ds-1 | DEBIAN-CVE-2026-87877 |
| Ubuntu:24.04:LTS | zstd-jni-java | no fix listed | UBUNTU-CVE-2026-87877 |
| Ubuntu:26.04:LTS | zstd-jni-java | no fix listed | UBUNTU-CVE-2026-87877 |
| Ubuntu:26.10 | zstd-jni-java | no fix listed | UBUNTU-CVE-2026-87877 |
Affected products (as reported)
Weakness: CWE-416 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
References
- GitHub Security Advisory (GHSA-2jw3-mg7f-vw4q) vendor-advisory
- Fix commit: closed-state guards on BaseZstdBufferDecompressingStreamNoFinalizer patch
- Fix commit: closed-state guards on the input and output stream setters patch
- Setters without the closed-state guard that readInternal already has, at v1.5.7-13 technical-description
- final stream handle retained after close at v1.5.7-13 technical-description
- zstd-jni v1.5.7-14 Release Notes release-notes
- Commit that made setDict write through the retained native stream handle (first released in 1.3.8-4) technical-description, patch
- https://github.com/luben/zstd-jni product
- VulnCheck Advisory: zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close() third-party-advisory