Intel

AIKIDO-2026-35074

zstd-jni is vulnerable to Use-After-Free

Use-After-FreeCVE-2026-87825 Published 2 days ago

77

High Risk

This Affects:

JAVAzstd-jni
1.3.8-4 - 1.5.7-13
Fixed in 1.5.7-14
Are you affected? Scan for Free

TL;DR

Stream and context setDict and loadDict methods hold the dictionary lock only while the native load call runs, then release it. close() on the dictionary frees the native dictionary while the stream or context still stores that pointer, so a later read or write uses freed memory and can crash the JVM. The fix keeps the dictionary lock until the stream or context is closed.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your code closes a dictionary that a stream or context still uses.

Background info

zstd-jni is vulnerable to Use-After-Free in versions 1.3.8-4 - 1.5.7-13.

How to fix this

Upgrade the com.github.luben:zstd-jni library to the patch version.

Links

Other

Are You Affected?

Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.

Free. No credit card required.

Aikido Platform