CVE-2026-93451

Overview

CVE-2026-93451 affects snappy-java library versions through 1.1.10.8, stemming from a buffer overflow in the uncompression routines. The vulnerability occurs due to incorrect length calculations when allocating output arrays during decompression. Attackers controlling the compressed input can potentially corrupt heap memory.

Description

snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompress*Array methods that allocate output arrays by dividing uncompressed length by element size but pass the undivided length to native code. Attackers controlling compressed input can cause misaligned length values to write past array bounds with attacker-controlled bytes, corrupting heap memory.

Impact

This vulnerability could lead to Confidentiality, Integrity, and Availability impacts. Successful exploitation may allow an attacker to corrupt heap memory, potentially leading to application crashes or, in some cases, arbitrary code execution. Organizations utilizing snappy-java for data compression/decompression should assess their exposure.

Remediation

Upgrade snappy-java to a version greater than 1.1.10.8. Review application dependencies to identify instances of the vulnerable library and apply the update. Implement robust input validation and sanitization procedures where snappy-java is used to process externally sourced compressed data.

Risk context

The vulnerability is rated as Medium severity with a CVSS v3 score of 6.5 and a CVSS v4 score of 6.9. No EPSS score is currently available. Defenders should prioritize patching based on the criticality of systems utilizing the affected library and the potential for external input control.

Affected products

• snappy-java <= 1.1.10.8