Vulnerability · Published Sep 17, 2026 · Assigned by VulnCheck
CVE-2026-93451snappy-java through 1.1.10.8 Buffer Overflow via typed uncompress methods
Medium 6.5
In plain English
A medium-severity out-of-bounds write in snappy-java from xerial. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompress*Array methods that allocate output arrays by dividing uncompressed length by element size but pass the undivided length to native code. Attackers controlling compressed input can cause misaligned length values to write past array bounds with attacker-controlled bytes, corrupting heap memory.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.xerial.snappy:snappy-java | 1.1.10.9 | GHSA-gwq9-9ffj-mvrv |
| Ubuntu:22.04:LTS | snappy-java | no fix listed | UBUNTU-CVE-2026-93451 |
| Ubuntu:24.04:LTS | snappy-java | no fix listed | UBUNTU-CVE-2026-93451 |
| Ubuntu:26.04:LTS | snappy-java | no fix listed | UBUNTU-CVE-2026-93451 |
| Ubuntu:26.10 | snappy-java | no fix listed | UBUNTU-CVE-2026-93451 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| xerial | snappy-java | 0 – through 1.1.10.8 |
Weakness: CWE-787 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
References
- GitHub Issue #729 issue-tracking
- https://github.com/xerial/snappy-java/blob/v1.1.10.8/src/main/java/org/xerial/snappy/Snappy.java#L802 technical-description
- https://github.com/xerial/snappy-java product
- VulnCheck Advisory: snappy-java through 1.1.10.8 Buffer Overflow via typed uncompress methods third-party-advisory