The vulnerability stems from zstd-jni versions 1.1.1 through 1.5.7-13. Direct-ByteBuffer frame-size native methods perform signed 32‑bit bounds checks on offsets, allowing an attacker to provide negative or overflowing values. Negative offsets near Integer.MIN_VALUE trigger reads of unmapped or unintended memory. This can terminate the Java Virtual Machine or let an attacker extract arbitrary frame size data from memory regions not intended for the buffer.

The affected product is the zstd-jni library distributed by Luben. All releases from version 1.1.1 up to and including 1.5.7-13 are impacted. This library is often used in Java applications that rely on Zstandard compression.

The CVSS base score is 8.8, indicating a high severity. The EPSS score is not available, so the current data do not quantify exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the ability to influence the buffer offset used by the native library, which is typically achievable in contexts where the attacker controls input data to the compression/decompression routines. An attacker could trigger abrupt JVM termination or read sensitive memory, potentially leading to denial‑of‑service or information disclosure.