EUVD-2026-75024
GHSA-mwq5-v3w5-qr6v
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local access required to invoke JVM methods; no system privileges needed; no confidentiality impact; high integrity and availability from heap corruption and JVM crash.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM.
AnalysisAI
Use-after-free in zstd-jni versions 1.3.8-4 through 1.5.7-13 allows callers to invoke setDict, setLongMax, setLevel, and setRefMultipleDDicts on already-closed stream objects, writing through freed native (JNI) pointers into arbitrary JVM memory. The root cause is missing closed-state validation in stream classes such as BaseZstdBufferDecompressingStreamNoFinalizer and ZstdInputStreamNoFinalizer, meaning the JNI layer operates on native context structures that have already been released. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the ability to call setDict, setLongMax, setLevel, or setRefMultipleDDicts on a zstd-jni stream instance that has already had close() invoked on it. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H) scores 7.0, reflecting local attack vector, low complexity, no privilege requirement, and high integrity plus availability impact with no confidentiality loss. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade zstd-jni to version 1.5.7-14 or later; the patched release is confirmed at https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14, and the fixing commits are f38f9a1563113d96d0fc38baee543f7457dd8a8e, 393d7311766abbc285b149302c0fe1f94b16d555, and 0827ed02551bbd8d6f8e4bbff99d83bf50f91938. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Java applications using zstd-jni, focusing on those processing untrusted data or operating in production environments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Out-of-bounds read in zstd-jni versions 1.2.0 through 1.5.7-13 allows attackers who can supply dictionary constructor pa
Out-of-bounds read in zstd-jni versions 1.2.0 through 1.5.7-13 exposes JVM-based applications to service termination and
Out-of-bounds read in zstd-jni versions 1.5.5-6 through 1.5.7-13 exposes JVM-based applications to memory disclosure or
Out-of-bounds memory reads in zstd-jni versions 1.1.1 through 1.5.7-13 allow unauthenticated remote attackers to crash t
Out-of-bounds memory access in zstd-jni versions 1.3.3-1 through 1.5.7-13 enables unauthenticated network-accessible att
Use-after-free in zstd-jni versions 1.3.8-4 through 1.5.7-13 allows attackers to trigger silent data corruption or JVM c
Infinite-loop denial of service in zstd-jni versions 1.4.8-4 through 1.5.7-13 allows thread starvation by passing negati
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today