Use-after-free in zstd-jni versions 1.3.8-4 through 1.5.7-13 allows attackers to trigger silent data corruption or JVM crashes by closing a Zstandard dictionary after it has been associated with a stream or context. The library's locking design released the dictionary's shared lock immediately after the load call, leaving the stream holding a native pointer to freed memory; subsequent read or write operations on that stream then access freed native heap, producing undefined behavior at the JVM/native boundary. No public exploit has been identified at time of analysis, and a patched release (v1.5.7-14) is available with two upstream commits.
Certificate hostname validation failure in Dell Secure Connect Gateway (SCG) 5.0 enables an unauthenticated remote attacker positioned as a network man-in-the-middle to present a valid TLS certificate for a different host, defeating the connection's trust model and gaining unauthorized access to intercepted communications. Both the Appliance variant (prior to 5.36.00.16) and Application variant (prior to 5.36.00.00) are confirmed affected per Dell DSA-2026-382. No public exploit or CISA KEV listing has been identified at time of analysis; the AC:H CVSS metric reflects the non-trivial network positioning prerequisite.
OS command injection in Tanium Enforce enables a local attacker to execute arbitrary operating system commands at the privilege level of the Enforce agent process. The flaw (CWE-78) requires user interaction and specific exploitation preconditions, reflected in a CVSS 7.0 score despite full C:H/I:H/A:H impact ratings. Tanium self-disclosed the issue via advisory TAN-2026-022; no public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Use-after-free in zstd-jni versions 1.3.8-4 through 1.5.7-13 allows callers to invoke setDict, setLongMax, setLevel, and setRefMultipleDDicts on already-closed stream objects, writing through freed native (JNI) pointers into arbitrary JVM memory. The root cause is missing closed-state validation in stream classes such as BaseZstdBufferDecompressingStreamNoFinalizer and ZstdInputStreamNoFinalizer, meaning the JNI layer operates on native context structures that have already been released. Exploitation can corrupt unrelated heap objects or terminate the JVM process entirely. No public exploit code or CISA KEV listing is identified at time of analysis.