CVE-2026-89046

HighCVSS 8.2/10Last modified Sep 10, 2026

Description

zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds read vulnerability in Zstd.getFrameContentSize that fails to validate negative srcPosition arguments. Attackers can supply negative offset values that bypass bounds checks and reach the native frame-header parser, causing out-of-bounds memory reads that lead to information disclosure or JVM crashes.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Weakness enumeration

CWE-125

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 10, 2026
Last modified: Sep 10, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-890476.1The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL in all ve CVE-2026-890499.9A server-side request forgery issue due to improper validation of equivalent address representations in the port forwarding to remote hosts CVE-2026-89056.1The Osiris Signature Banner plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5. This CVE-2026-890504.3The Quads Ads Manager for Google AdSense WordPress plugin before 3.0.5 does not verify payment completion with the configured payment gatewa CVE-2026-890517.2The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'replaceHead CVE-2026-890525.9A hardcoded cryptographic key management vulnerability exists in Archer C6 due to the use of a universal cryptographic key shared across dev CVE-2026-890548.2A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for CVE-2026-890559.1The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.120.CVE-2026-890576.8A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain una CVE-2026-890587.4A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in t CVE-2026-890597.5A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the dec CVE-2026-89066.1The WP Promoter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3. This is due to m