Is CVE-2026-87877 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-87877?

CVE-2026-87877 has a CVSS v3 severity of HIGH (7.7).

Back

CVE-2026-87877

Description

zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM.