PT-2026-89525

🗓️ 10 Sep 2026 00:00:00Reported by Positive TechnologiesType

ptsecurity🔗 dbu.gs👁 30 Views

OOB read in zstd-jni 1.5.5-6 to 1.5.7-13 via negative srcPosition in getFrameContentSize.

Reporter	Title	Published	Views	Family All 227
IBM Security Bulletins	Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in zstd-jni, snappy-java, and Apache Parquet	6 Oct 202618:46	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities	24 Sep 202614:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in zstd-jni	9 Oct 202619:26	–	ibm
IBM Security Bulletins	Security Bulletin:Vulnerabilities exists in zstd package used by IBM Netezza Appliance	12 Oct 202608:23	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in zstd-jni.	22 Oct 202620:15	–	ibm
IBM Security Bulletins	Security Bulletin:Multiple vulnerabilities in zstd-jni may affect IBM Infosphere Change Data Capture (CVE-2026-89045, CVE-2026-89046, CVE-2026-90560)	26 Oct 202618:20	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Out-of-bounds Read and Infinite Loop condition in zstd-jni (CVE-2026-89045, CVE-2026-89046, CVE-2026-90560)	22 Oct 202620:14	–	ibm
IBM Security Bulletins	Security Bulletin:Multiple vulnerabilities in zstd-jni may affect IBM Infosphere Change Data Capture (CVE-2026-87795, CVE-2026-87823, CVE-2026-87824, CVE-2026-87825, CVE-2026-87877)	23 Oct 202608:58	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to zstd-jni.	22 Oct 202614:55	–	ibm
IBM Security Bulletins	Security Bulletin:Vulnerabilities exists in zstd package used by IBM Netezza Appliance	12 Oct 202608:20	–	ibm

Source	Link
osv	www.osv.dev/vulnerability/CLEANSTART-2026-GT00731
osv	www.osv.dev/vulnerability/CLEANSTART-2026-HC93535
github	www.github.com/luben/zstd-jni
osv	www.osv.dev/vulnerability/CLEANSTART-2026-QD39247
osv	www.osv.dev/vulnerability/CVE-2026-89045
github	www.github.com/luben/zstd-jni/releases/tag/v1.5.7-14
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-JW02170.json
repo1	www.repo1.maven.org/maven2/com/github/luben/zstd-jni
github	www.github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_zstd.c
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-LX98004.json

30 Oct 2026 00:00Current

7.2High risk

Vulners AI Score7.2

CVSS 48.8

CVSS 3.18.2

EPSS0.0065

SSVC

zstd-jni Out of Bounds getFrameContentSize Information Disclosure JVM Crash Negative Offset