zstd-jni <1.5.7-14: Closed Stream Write-Through via setDict/Level
CVE-2026-87877 Published on September 9, 2026
zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()
zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM.
Vulnerability Analysis
CVE-2026-87877 can be exploited with local system access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. Public availability of a proof of concept (POC) exploit exists for CVE-2026-87877. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is a Dangling pointer Vulnerability?
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.
CVE-2026-87877 has been classified to as a Dangling pointer vulnerability or weakness.
Products Associated with CVE-2026-87877
Want to know whenever a new CVE is published for Red Hat Kafka? stack.watch will email you.
Affected Versions
luben zstd-jni:- Version 1.3.8-4 and below 1.5.7-14 is affected.