Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder. The decoder does not validate back‑references and literal runs, allowing an attacker to provide a crafted LZF stream that causes the JVM to read beyond the bounds of the source buffer. This can lead to leakage of unrelated heap memory into the decompressed output or a JVM crash, resulting in data exposure and denial of service.

The vulnerability affects the Ning compress‑lzf library for all releases prior to 1.2.0, including the 1.1.3 version used in many Java applications that rely on LZF compression.

The CVSS score of 8.8 indicates a high severity of this flaw. While no EPSS value is available, the lack of a published exploit does not reduce the risk; the decoder can be triggered by any attacker who can supply a malicious compressed stream to an application that uses the UnsafeChunkDecoder. Since the vulnerability is not listed in the CISA KEV catalog, there is no known widespread exploitation on record, but the potential for data leakage and crashing of the JVM makes timely mitigation important.