CVE-2026-87823
zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds m
CVSS
8.2
Alto
EPSS
—
KEV
—
Exploit Today
—
0-100
Publicado: 9 sept 2026 · Última mod.: 9 sept 2026 · CWE-190
Sin historial EPSS suficiente todavía.
zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MIN_VALUE to read unmapped memory, causing JVM termination or extracting arbitrary frame size data from unintended memory locations.
- github.comhttps://github.com/luben/zstd-jni
- github.comhttps://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/Zstd.java
- github.comhttps://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_zstd.c
- github.comhttps://github.com/luben/zstd-jni/commit/46dcb2a54c8b8f2ce2cad7187a7513f509c533ac
- github.comhttps://github.com/luben/zstd-jni/commit/d7a1c99322d5e1fc71932e722c0b5bb2fc525d3f
- github.comhttps://github.com/luben/zstd-jni/releases/tag/v1.5.7-14
- github.comhttps://github.com/luben/zstd-jni/security/advisories/GHSA-jfr6-9xqw-2g2q
- www.vulncheck.comhttps://www.vulncheck.com/advisories/zstd-jni-1.1.1-through-1.5.7-13-out-of-bounds-read-via-direct-bytebuffer-frame-size-methods
- github.comhttps://github.com/luben/zstd-jni/security/advisories/GHSA-jfr6-9xqw-2g2q
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-567118.8 ALT—
———VLC media player computes the size of a picture buffer with 32-bit arithmetic and allocates from the wrapped result. In AllocatePicture in src/misc/picture.c the running total is accumulated as i_bytes += p->i_pitch * p->i_lines, and both plane_t fields are declared int in include/vlc_picture.h, so the multiplication is evaluated at 32 bits and wraps before it is widened to the size_t accumulator. The overflow check that precedes it divides in 64-bit arithmetic and therefore does not constrain the product, and the subsequent comparison against PICTURE_SW_SIZE_MAX examines the already wrapped value, so both guards pass. aligned_alloc then reserves the small wrapped size while the decoder writes scanlines sized from the original dimensions. A crafted PNG whose IHDR declares large width and height reaches this path through the image demuxer, whose only size guard is on the input file's byte count rather than the declared dimensions, and the decoder in modules/codec/png.c writes past the end of the allocation with attacker-influenced length and content. Opening the file directly or through a playlist entry is sufficient, with no non-default settings.12hCVE-2026-876439.6 CRÍ—
——0Integer overflow in GPU in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)9hCVE-2026-87630——
——0Integer overflow in WebRTC in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)11hCVE-2026-819877.8 ALT—
——0Acrobat Reader is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.11hCVE-2026-820077.8 ALT—
——0Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.16hCVE-2026-758637.8 ALT—
——0Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.16h