cyfenced.com →

[ CVE-2026-93451 · Published 17 Sep 2026 ]

snappy-java: Heap buffer overflow in Snappy.uncompress*Array typed-array methods

CVSS 6.5 EPSS <1%1 agency advisoryFix available

[ Description ]Official description

snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompress*Array methods that allocate output arrays by dividing uncompressed length by element size but pass the undivided length to native code. Attackers controlling compressed input can cause misaligned length values to write past array bounds with attacker-controlled bytes, corrupting heap memory.

[ Fixes ]Fixes and patches

[ Advisories ]Government CERT advisories

  • CERT-FRCERTFR-2026-AVI-1385

    Multiple vulnerabilities in VMware products Translated from French

    Multiple vulnerabilities have been discovered in VMware products. They allow an attacker to cause a security problem not specified by the vendor.

    CVE-2019-25013CVE-2017-9937CVE-2025-6395+4953 more CVEs

[ Packages ]Affected open-source packages

  • org.xerial.snappy:snappy-java mavenAffected <= 1.1.10.8 · fixed in 1.1.10.9 · GHSA-gwq9-9ffj-mvrv

[ References ]References