The vulnerability arises when the zstd decoder in the compress library processes a specially crafted two‑block frame. A frame containing an FSE normalized count of 32768 is stored as a signed int16, yielding –32768. This negative value is then used later to build a stale decode‑table, allowing the decoder to index beyond the bounds of its table and trigger a panic. The panic results in a crash of any application that uses the decoder, giving an attacker the ability to destabilize the target system or application with untrusted zstd input.

Vendor klauspost:compress. Versions prior to 1.20.2 are affected. The issue was addressed in release v1.20.2 and later versions. Applications that depend on this library or process zstd data from external sources are potentially impacted.

The CVSS score of 8.7 indicates a high impact vulnerability. No EPSS score is currently available, so an exact exploitation probability cannot be quantified, but the lack of a KEV listing suggests this vulnerability has not yet been observed in the wild. The attack vector is likely Remote Delivery via an injected or user‑supplied zstd stream that contains the malicious frame structure. By causing an unhandled panic, an attacker can bring the host application or service down, leading to denial of service.