The flaw is a double release of pooled buffers within SnappyFramedInputStream. When an allocation for a new buffer fails, the existing buffer is returned twice, allowing additional data to be written into the same memory region. An attacker can craft Snappy-compressed data with a large declared chunk length that triggers an OutOfMemoryError and forces this double release. The result is that the backing array of a decompressed frame may become shared among different stream instances, leading to overwritten or exposed decompressed data.

The vulnerability affects the Xerial snappy-java library in any distribution that uses version 1.1.7.4 through 1.1.10.9 inclusive. Any Java application that relies on SnappyFramedInputStream for decoding Snappy frames is susceptible unless updated to 1.1.10.10 or later.

With a CVSS score of 6.3, the vulnerability is considered medium severity. The exploit is achievable without special privileges by sending crafted Snappy content to any component that performs framed decompression. Although the EPSS score is below 1%, indicating a very low probability of exploitation, there are no industrial exploitation reports and the vulnerability is not listed in CISA’s KEV catalog, the likelihood of exploitation remains moderate due to the widespread use of snappy‑java and the simplicity of the attack vector.