Description
A vulnerability has been found in luben zstd-jni up to 1.5.7-13. This vulnerability affects the function ZstdCompressCtx.loadDict of the file ZstdCompressCtx.java of the component Dictionary Sharing. Such manipulation leads to use after free. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.7-14 is able to resolve this issue. The name of the patch is a560131d7834598afd9cea6b7c107bc88e915936. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| luben | zstd-jni | 1.5.7-13 | 1.5.7-14 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | zstd-jni-java | 1.5.7-23+ds-1 | — |
| Debian 13 | zstd-jni-java | No fix yet | — |
| Debian 12 | zstd-jni-java | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | zstd-jni-java | No fix yet | — |
| Ubuntu 26.04 LTS | zstd-jni-java | No fix yet | — |
| Ubuntu 24.04 LTS | zstd-jni-java | No fix yet | — |
Advisories 1
- WID-SEC-2026-3791 IBM SPSS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 8, 2026
References
- VDB-403407 | luben zstd-jni Dictionary Sharing ZstdCompressCtx.java ZstdCompressCtx.loadDict use after free vdb-entry technical-description
- VDB-403407 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- CVE-2026-90852 | CVE Analysis and Report third-party-advisory
- Submit #927022 | luben zstd-jni 1.5.7-13 Cross-Object Use-After-Free third-party-advisory
- https://github.com/luben/zstd-jni/issues/404 exploit issue-tracking
- https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936 patch
- https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14 patch
- https://github.com/luben/zstd-jni/ product