Use After Free

Overview Affected versions of this package are vulnerable to Use After Free in the setDict, setLongMax, setLevel, and setRefMultipleDDicts methods of its streaming classes. An attacker can corrupt native heap state or crash the JVM by calling these setters on a stream after close, causing them to...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read due to the ZstdDictCompressbyte dict, int offset, int length, int level constructor in ZstdDictCompress.java. An attacker can trigger a native heap read, crash the JVM, or leak adjacent memory by supplying a negative...

DEBIAN-CVE-2026-87795

zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or length values to read native heap memory into the compression dictionary, typically causing JVM crashe...

CVE-2026-87795 zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictCompress

zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or length values to read native heap memory into the compression dictionary, typically causing JVM crashe...

CVE-2026-87795

zstd-jni versions before 1.5.7-14 contain an out-of-bounds read vulnerability in the ZstdDictCompress constructor. The library fails to validate offset and length parameters, allowing an attacker to supply untrusted values that cause reads of native heap memory into the compression dictionary. Th...

CVE-2026-87795: Out-of-bounds Read

zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or length values to read native heap memory into the compression dictionary, typically causing JVM crashe...

Pillow: Pillow: Native heap out-of-bounds write

A flaw was found in Pillow prior to 12.3.0. The public RankFilter API can trigger a native heap out-of-bounds write when given a very large odd filter size. ImageFilter.RankFilter.filter calls image.expandsize // 2, size // 2 before rank-filter size validation, and ImagingExpand computes output...

Pillow: Pillow: Native heap out-of-bounds write

A flaw was found in Pillow prior to 12.3.0. The public RankFilter API can trigger a native heap out-of-bounds write when given a very large odd filter size. ImageFilter.RankFilter.filter calls image.expandsize // 2, size // 2 before rank-filter size validation, and ImagingExpand computes output...

CVE-2026-59205

Pillow (Python imaging library) contains a vulnerability in ImageCmsTransform.apply(im, imOut): before version 12.3.0, supplying an output image whose mode does not match the transform’s declared output mode can trigger a controlled native heap corruption. Affected component is ImageCmsTransform....