Zero Radar
← feed
HighVulnerabilityCVE-2026-93451updated 27 Oct 2026, 15:34 UTC

Snappy-java can overwrite memory when decompressing typed arrays

A data-compression library can be tricked into writing a few bytes past the end of a memory buffer when decompressing certain data. This can corrupt the program's memory and may crash it or cause unpredictable behavior.

Fix availableOfficial source
SeverityHighCVSS 7.5 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yesorg.xerial.snappy:snappy-java 1.1.10.9 · since 27 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Crafted inputAttacker supplies compressed data with odd byte length
  2. 2Typed decompress callApp calls uncompressIntArray or similar
  3. 3Out-of-bounds writeNative code writes up to 7 bytes past array end
  4. 4Heap corruptedAdjacent memory overwritten
  5. ResultHeap corruption, possible crash or misbehavior

What happened

In snappy-java, the uncompressCharArray, uncompressShortArray, uncompressIntArray, uncompressLongArray, uncompressFloatArray and uncompressDoubleArray methods size the output array by dividing the declared uncompressed byte length by the element size, but the native code writes the full byte length. When the declared length is not a multiple of the element size, up to 7 bytes are written past the end of the Java array, corrupting the heap.

Why it is dangerous: Heap corruption can crash the application or be used to alter program behavior. Applications that decompress untrusted or attacker-supplied compressed data into these typed arrays are at risk.

Are you affected?

You are affected if you use org.xerial.snappy:snappy-java 1.1.10.8 or earlier and call any of the typed uncompress*Array methods on compressed input you do not fully control.

Package / productAffected versionsFixed in
org.xerial.snappy:snappy-java · maven<= 1.1.10.81.1.10.9

What to do

  1. Update org.xerial.snappy:snappy-java to 1.1.10.9 or later
  2. If you cannot update yet, check that Snappy.uncompressedLength(input) is a multiple of the element size before calling the typed uncompress methods

Timeline

  1. 27 Oct 2026, 15:33 UTC
    Publicly disclosed
  2. 27 Oct 2026, 15:33 UTC
    Reported by GitHub Advisory · GitHub Advisory
  3. 27 Oct 2026, 15:34 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-93451 · GHSA-gwq9-9ffj-mvrv
CVSS
7.5 / 10
EPSS
0.3% chance of exploitation within 30 days
Disclosed
27 Oct 2026, 15:33 UTC
On Zero Radar
27 Oct 2026, 15:34 UTC (1 min after disclosure)
Last change
27 Oct 2026, 15:34 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Snappy-java can overwrite memory when decompressing typed arrays · Zero Radar