Vulnerability · Published Sep 12, 2026 · Assigned by VulnCheck
CVE-2026-90559snappy-java through 1.1.10.8 Out-of-Bounds Write via uncompress
High 7.5
In plain English
A high-severity out-of-bounds write in snappy-java from xerial. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.6%top 49.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
snappy-java through 1.1.10.8 contains an out-of-bounds write vulnerability in Snappy.uncompress(ByteBuffer, ByteBuffer) because destination buffer capacity is never validated against decompressed size. Attackers can supply valid compressed data that decompresses larger than the destination buffer, causing writes past buffer boundaries and JVM termination.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| xerial | snappy-java | 0 – through 1.1.10.8 |
Weakness: CWE-787 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- GitHub Issue #728 issue-tracking
- https://github.com/xerial/snappy-java product
- https://github.com/xerial/snappy-java/blob/v1.1.10.8/src/main/java/org/xerial/snappy/Snappy.java#L561 technical-description
- VulnCheck Advisory: snappy-java through 1.1.10.8 Out-of-Bounds Write via uncompress third-party-advisory