Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-87825— zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free of Compression and Decompression Dictionaries

Quick assessment

Affected

luben zstd-jni

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

luben karavelov Zstd-jni是luben karavelov个人开发者开源的一款为应用程序提供高性能压缩算法本地接口的组件。 luben karavelov Zstd-jni 1.3.8-4至1.5.7-14之前版本存在资源管理错误漏洞，该漏洞源于释放后重用，流和环境在加载调用期间仅持有字典共享锁，导致字典在仍被引用时被关闭，后续读写操作会访问已释放的原生内存，可能造成数据静默损坏或JVM崩溃。

CVSS 7.7 · High EPSS 0.21% · P12 Updated Sep 14, 2026

Possible ATT&CK Techniques 2 AI

T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
luben	zstd-jni	`1.3.8-4< 1.5.7-14`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-87825

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free of Compression and Decompression Dictionaries

Source: CVE Program / CVE List V5

Vulnerability Description

zstd-jni before 1.5.7-14 contains a use-after-free vulnerability where streams and contexts hold a dictionary's shared lock only during the load call, allowing the dictionary to be closed while still referenced. Attackers can close a dictionary after associating it with a stream or context, causing subsequent read or write operations to access freed native memory, resulting in silent data corruption or JVM crashes.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

释放后使用

Source: CVE Program / CVE List V5

Vulnerability Title

luben karavelov Zstd-jni 资源管理错误漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
luben	zstd-jni	1.3.8-4 ~ 1.5.7-14	-

II. Public POCs for CVE-2026-87825

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-87825

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-87825 (5)

Vendor Advisories for CVE-2026-87825 (2)

Proof of Concept for CVE-2026-87825 (1)

🔗 GitHub - luben/zstd-jni: JNI binding for Zstd · GitHub Read full article product

Vendor Pages for CVE-2026-87825 (1)

🔗 Release v1.5.7-14 · luben/zstd-jni · GitHub Read full article release-notes

https://www.cve.org/CVERecord?id=CVE-2026-87825

Same Patch Batch · luben · 2026-09-09 · 5 CVEs total

CVE-2026-87795	8.2 HIGH	zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictCompress
CVE-2026-87823	8.2 HIGH	zstd-jni 1.1.1 through 1.5.7-13 Out-of-Bounds Read via Direct ByteBuffer Frame-Size Method
CVE-2026-87877	7.7 HIGH	zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()
CVE-2026-87824	7.5 HIGH	zstd-jni 1.3.3-1 through 1.5.7-13 Out-of-Bounds Read via Zstd.trainFromBufferDirect

IV. Related Vulnerabilities

Same product: zstd-jni

Same vendor: luben

Same weakness: CWE-416