An out-of-bounds memory read vulnerability in zstd-jni allows attackers to trigger JVM crashes or access unauthorized memory via crafted direct-ByteBuffer frame-size requests.

The library performs improper 32-bit signed bounds checks on native methods handling direct ByteBuffers. An unauthenticated attacker can supply malicious negative offset values near Integer.MIN_VALUE, leading to out-of-bounds memory reads or JVM termination.

Successful exploitation of this vulnerability poses a significant risk to application stability and data integrity. By causing a JVM crash, an attacker can induce a denial-of-service condition, disrupting critical business operations. Furthermore, the ability to read unmapped or unintended memory locations could lead to the exposure of sensitive information residing in the application process memory, which is a high-severity concern under CVSS 8.2 scoring.

Immediate Action: Update the zstd-jni library to version 1.5.7-14 or later immediately to incorporate the corrected bounds checking logic.

Proactive Monitoring: Monitor application logs for unexpected JVM termination events or recurring memory access errors that may indicate exploitation attempts.

Compensating Controls: While there is no direct virtual patch, ensure the application is running with the principle of least privilege to limit the impact of a potential process crash or unauthorized memory access.

Public Exploit Available: No (exploit_available: unknown)

Given the High severity of this vulnerability and the confirmed existence of proof-of-concept material, organizations utilizing zstd-jni must prioritize upgrading to version 1.5.7-14. Failure to patch leaves applications vulnerable to service disruption and potential memory disclosure, necessitating an immediate deployment of the vendor-provided fix.