The zstd-jni library contains a use‑after‑free bug where calling setDict, setLongMax, setLevel, or setRefMultipleDDicts after a stream has been closed dereferences freed native pointers. This can corrupt memory, crash the JVM, and may allow arbitrary code execution. The flaw is a classic CWE‑416 scenario.

All zstd‑jni versions from 1.3.8‑4 through 1.5.7‑13 released by the luben project are vulnerable. The issue is present in BaseZstdBufferDecompressingStreamNoFinalizer and ZstdInputStreamNoFinalizer sources, affecting any Java application that uses these streams and invokes the setter methods after close.

With a CVSS score of 7, the vulnerability is considered high severity. No EPSS score is reported, so current exploitation probability is unknown, though the flaw has not been listed in CISA KEV. In practice, an attacker would need to trigger the setter methods on a closed stream, which could be achieved through insecure application logic or crafted input. Given the native pointer misuse, the risk to system integrity and confidentiality is significant, especially in trusted or privileged runtimes.