CyberRota Analysis
AI-GeneratedVersions 1.5.5-6 through 1.5.7-13 of zstd-jni are vulnerable due to an out-of-bounds read in the Zstd.getFrameContentSize method, which improperly handles negative srcPosition arguments. This flaw allows attackers to exploit the vulnerability by supplying negative offsets, potentially leading to information disclosure or crashes of the Java Virtual Machine. Organizations using affected versions should prioritize patching this vulnerability to mitigate the risk of data leakage and service disruption.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds read vulnerability in Zstd.getFrameContentSize that fails to validate negative srcPosition arguments. Attackers can supply negative offset values that bypass bounds checks and reach the native frame-header parser, causing out-of-bounds memory reads that lead to information disclosure or JVM crashes.