A critical out-of-bounds read vulnerability in the zstd-jni library could allow unauthenticated attackers to cause application crashes or perform information disclosure.

This flaw is an out-of-bounds read (CWE-125) triggered by the failure to validate negative srcPosition arguments in the Zstd.getFrameContentSize method. An unauthenticated attacker can supply malicious negative offset values that bypass bounds checking, leading to memory access outside the intended buffer.

Successful exploitation of this vulnerability can lead to service disruption via JVM crashes, potentially causing significant downtime for applications relying on the affected library. Furthermore, the ability to perform out-of-bounds memory reads presents a risk of sensitive information disclosure from the application's memory space. Given the high CVSS score of 8.2, this vulnerability poses a substantial risk to system stability and data confidentiality.

Immediate Action: Upgrade the zstd-jni library to version 1.5.7-14 or later, which includes the necessary validation logic to prevent negative offset exploitation.

Proactive Monitoring: Monitor application logs for unexpected JVM crashes, particularly those involving native code errors or segmentation faults that may indicate failed or successful exploitation attempts.

Compensating Controls: While no direct WAF rule can perfectly mitigate this memory-level flaw, ensure that input validation is enforced at the application layer to block unexpected or negative numerical inputs passed to compression-related functions.

Public Exploit Available: Unknown.

The vulnerability in zstd-jni represents a significant risk to JVM-based environments due to the potential for memory corruption and service instability. Security teams should prioritize the update to version 1.5.7-14 immediately to close the identified gap. Failure to patch may expose backend systems to stability risks if they process untrusted data through the affected compression methods.