CVE-2026-90560 - zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictDecompress
Brief
CVE ID : CVE-2026-90560
Published : Sept. 12, 2026, 6:16 p. m.
- 2 hours, 36 minutes ago
Description : zstd-jni versions 1.
- 0 through 1.
- 7-13 contain an out-of-bounds read vulnerability in the ZstdDictDecompress constructor because offset and length arguments are never validated against the dictionary array bounds. Attackers can supply arbitrary offset or length values to read memory past the end of the supplied array, potentially causing JVM termination.
Severity: 8.8
- HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...