CVE-2026-89046

Publié : 10 septembre 2026

Modifié : 10 septembre 2026

Score CVSS

8.2

HIGH

Description détaillée

zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds read vulnerability in Zstd.getFrameContentSize that fails to validate negative srcPosition arguments. Attackers can supply negative offset values that bypass bounds checks and reach the native frame-header parser, causing out-of-bounds memory reads that lead to information disclosure or JVM crashes.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Références et Patchs

https://github.com/luben/zstd-jni https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/Zstd.java#L730 https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_zstd.c#L87 https://github.com/luben/zstd-jni/commit/dd08685ef913a32e76fb27f43470035c06758646 https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14 https://github.com/luben/zstd-jni/security/advisories/GHSA-rm53-6wf5-f34m https://www.vulncheck.com/advisories/zstd-jni-1.5.5-6-through-1.5.7-13-out-of-bounds-read-via-negative-offset https://github.com/luben/zstd-jni/security/advisories/GHSA-rm53-6wf5-f34m

Dernières Vulnérabilités

CVE-2026-89179

WeenyGenius, a computer lab management system by Howyar Technologies, has a Missing Support for Integrity Check vulnerability. Unauthenticated attackers on the same network can intercept a student's connection packet and replay it, thereby forging the appearance that the student remains connected.

VOIR DÉTAILS

CVE-2026-89178

WeenyGenius, a computer lab management system by Howyar Technologies, has an Origin Validation Error vulnerability. Unauthenticated attackers on the same network can spoof the teacher workstation and send broadcast packets, causing student computers to attempt to establish a connection with the attacker.

VOIR DÉTAILS

CVE-2026-89177

WeenyGenius, a computer lab management system by Howyar Technologies, has a Use of Insecure Protocol vulnerability. Due to the reliance on ZMTP Null mode, unauthenticated attackers on the same network can capture packets to leak transmitted data, or perform replay attacks with forged commands to disrupt classroom operations.

VOIR DÉTAILS