snappy-java Buffer Overflow Flaws

Memory corruption in snappy-java through 1.1.10.8 lets an attacker terminate the JVM hosting the library: the Snappy.compress(ByteBuffer, ByteBuffer) overload writes past the end of the destination buffer when incompressible input exceeds its remaining capacity, corrupting off-heap memory. Exposure is limited to Java applications that call that specific ByteBuffer overload with attacker-influenceable, low-compressibility data and a destination buffer that was not sized using Snappy.maxCompressedLength(); code using the byte[]-based compress API or compressing only trusted data is not exposed. The flaw is reachable by unauthenticated remote attackers (CVSS 4.0 vector reports PR:N, and the independent assessment agrees with AV:N/PR:N/UI:N), but the impact is availability-only - no confidentiality or integrity loss and no code execution - and no public exploit code or confirmed active exploitation was identified at time of analysis.

Heap memory corruption in snappy-java 1.1.10.8 and earlier allows remote attackers to write attacker-influenced bytes past the bounds of the output array when an application decompresses untrusted compressed data through the typed Snappy.uncompress*Array APIs (such as uncompressIntArray, uncompressFloatArray, or uncompressDoubleArray), which size their result array using the uncompressed length divided by element size while forwarding the undivided length to the native JNI layer. Per the assessed vector (CVSS 3.1 AV:N/AC:L/PR:N/UI:N, C:N/I:L/A:L) no authentication or user interaction is needed, but exploitation is conditional: the consuming application must expose the typed decompression path to attacker-controlled input, and applications that only use the generic byte[] uncompress path are not exposed. Impact is currently rated Low integrity and Low availability (heap corruption and crash) with no confirmed confidentiality loss or demonstrated code execution, and no public exploit was identified at time of analysis; this is a genuine memory-corruption flaw but a moderate, not top-tier, priority, and no vendor-released fixed version is identified in the available data.