The vulnerability allows an attacker to pass a negative offset to Zstd.getFrameContentSize. The native frame‑header parser does not validate the srcPosition argument, so negative values bypass bounds checks and cause an out‑of‑bounds read of memory that can expose sensitive data or crash the Java Virtual Machine. This weakness is a classic out‑of‑bounds read flaw and can impact confidentiality and availability of applications that use the affected library. The description does not state an exploitation vector, but the likely attack path would involve supplying a crafted negative offset through any Java code that calls the vulnerable method. Based on the description, it is inferred that the attack vector requires execution of code within the application context.

The affected product is zstd‑jni by the luben project. Versions 1.5.5‑6 through 1.5.7‑13 contain the flaw. Users of these releases are vulnerable. The release tagged version that removes the defect and should be considered a safe target for update.

The CVSS score of 8.8 reflects a high severity due to potential data disclosure and denial of service. EPSS information is not available, so no current estimate of exploitation likelihood can be provided. The vulnerability is not listed in CISA KEV, indicating that no known exploits have been reported in the CISA catalog. Attackers would need to invoke the vulnerable method with a negative offset, which is easy to achieve if input is not validated. Because the flaw resides in a widely used compression library, the risk can affect many Java applications. Given the high CVSS and the explicit mention of memory reads that leak data, the threat remains significant until the library is updated to a non‑vulnerable version.