Use-After-Free in ZstdCompressCtx.loadDict (luben/zstd-jni <v1.5.7-14)
CVE-2026-90852 Published on September 15, 2026
luben zstd-jni Dictionary Sharing ZstdCompressCtx.java ZstdCompressCtx.loadDict use after free
A vulnerability has been found in luben zstd-jni up to 1.5.7-13. This vulnerability affects the function ZstdCompressCtx.loadDict of the file ZstdCompressCtx.java of the component Dictionary Sharing. Such manipulation leads to use after free. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.7-14 is able to resolve this issue. The name of the patch is a560131d7834598afd9cea6b7c107bc88e915936. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Timeline
Advisory disclosed
VulDB entry created
VulDB entry last update
Weakness Types
What is a Dangling pointer Vulnerability?
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.
CVE-2026-90852 has been classified to as a Dangling pointer vulnerability or weakness.
What is a Buffer Overflow Vulnerability?
The software performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.
CVE-2026-90852 has been classified to as a Buffer Overflow vulnerability or weakness.
Products Associated with CVE-2026-90852
stack.watch emails you whenever new vulnerabilities are published in Luben Zstd Jni or Red Hat Kafka. Just hit a watch button to start following.
Affected Versions
luben zstd-jni:- Version 1.5.7-13 is affected.
- Version 1.5.7-14 is unaffected.