Technical impact
The vulnerability lies in the zstd-jni library’s ZstdDictCompress constructor, which does not validate the offset and length parameters supplied when creating a compression dictionary. An attacker providing untrusted offset or length values can cause the native library to read beyond the allocated memory, exposing native heap data and frequently resulting in Java Virtual Machine crashes. The weakness is categorized as CWE-125, an Out-of-Bounds Read.
Affected Systems
This flaw affects the zstd-jni Java bindings, specifically all releases from 1.2.0 up to and including 1.5.7-13. Versions 1.5.7-14 and newer contain the required validation and are considered safe.
Risk and Exploitability
The CVSS score of 8.8 marks this issue as a high severity vulnerability. Exploitability details are limited; the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector requires an attacker to supply controlled input to the ZstdDictCompress constructor, which generally implies local or application-level exploitation. While it does not provide immediate remote code execution, the ability to read arbitrary native memory and trigger JVM crashes can lead to denial of service and potential leakage of sensitive data stored on the heap.
