Technical impact
The zstd-jni library contains a use–after–free condition where a compression or decompression stream retains a reference to a dictionary’s lock only during the load operation. If the dictionary object is closed thereafter, the lock is released while the stream still points to unmanaged memory. Subsequent read or write operations then dereference freed native memory, causing silent corruption of the processed data or a JVM crash, which compromises data integrity and availability.
Affected Systems
The vulnerability affects the zstd‑jni library distributed by the luben vendor. All releases from version 1.3.8‑4 through 1.5.7‑13 are impacted. Java applications that incorporate any of these releases—including dependency transitively used by other applications—are susceptible.
Risk and Exploitability
The CVSS score of 7 denotes a high severity vulnerability, but the EPSS score is unavailable, so public exploitation likelihood is unclear. The flaw is not listed in the CISA KEV catalog. Attackers would need control inside a JVM execution environment to close an in‑use dictionary; remote exploitation without that control is unlikely. Local exploitation can corrupt data or cause a denial of service by terminating the JVM.
