A critical out-of-bounds read vulnerability in the zstd-jni library could allow an attacker to cause a denial of service by triggering a JVM crash.

The ZstdDictDecompress constructor fails to validate offset and length arguments against the actual dictionary array bounds, which creates an out-of-bounds read condition (CWE-125). This flaw is reachable by unauthenticated attackers who can provide malicious input to the affected constructor.

The ability to trigger a JVM termination constitutes a significant availability risk for any Java-based application relying on the zstd-jni library for data compression or decompression. Given the CVSS score of 8.2, this vulnerability is classified as High severity because it allows an attacker to disrupt critical services, potentially leading to extended downtime and operational instability.

Immediate Action: Update the zstd-jni library to version 1.5.7-14 or later to incorporate the necessary bounds checking logic.

Proactive Monitoring: Monitor application logs for unexpected JVM crashes or segmentation faults that may indicate an exploitation attempt targeting the library.

Compensating Controls: If immediate patching is not feasible, restrict access to services that process untrusted dictionary data to prevent unauthorized users from reaching the vulnerable constructor.

Public Exploit Available: Unknown

The risk posed by this vulnerability is substantial due to the potential for service interruption. Security teams must prioritize updating the zstd-jni dependency to version 1.5.7-14 immediately to ensure the integrity and stability of the application environment.