CVE-2026-87877

zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM...

DEBIAN-CVE-2026-87877

zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM...

EUVD-2026-75024

zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM...

PT-2026-89056

Name of the Vulnerable Software and Affected Versions zstd-jni versions prior to 1.5.7-14 Description The issue is a use-after-free condition occurring in the stream classes. The setDict, setLongMax, setLevel, and setRefMultipleDDicts functions fail to validate whether the stream is in a closed...