Log in Start free

Vulnerability · Published Sep 12, 2026 · Assigned by VulnCheck

CVE-2026-90560zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictDecompress

High 8.2

In plain English

A high-severity out-of-bounds read in zstd-jni from luben. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.2High
Exploit odds (30 days)0.6%top 50.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read vulnerability in the ZstdDictDecompress constructor because offset and length arguments are never validated against the dictionary array bounds. Attackers can supply arbitrary offset or length values to read memory past the end of the supplied array, potentially causing JVM termination.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12zstd-jni-javano fix listedDEBIAN-CVE-2026-90560
Debian:13zstd-jni-javano fix listedDEBIAN-CVE-2026-90560
Debian:14zstd-jni-java1.5.7-23+ds-1DEBIAN-CVE-2026-90560
Ubuntu:24.04:LTSzstd-jni-javano fix listedUBUNTU-CVE-2026-90560
Ubuntu:26.04:LTSzstd-jni-javano fix listedUBUNTU-CVE-2026-90560
Ubuntu:26.10zstd-jni-javano fix listedUBUNTU-CVE-2026-90560

Affected products (as reported)

VendorProductVersions
luben zstd-jni 1.2.0 – before 1.5.7-14

Weakness: CWE-125 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

References