{"id":"CVE-2026-93452","title":"snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in Snappy.compress(ByteBuffer, ByteBuffer) that writes past the end of the destination buffer","summary":"snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in Snappy.compress(ByteBuffer, ByteBuffer) that writes past the end of the destination buffer. Attackers can supply incompressible data that exceeds the destination bu…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-787"],"vendor":"xerial","product":"snappy-java","affected":["snappy-java <= 1.1.10.8"],"published":"2026-09-18","updated":"2026-09-22","sourceUpdated":"2026-09-22T20:25:55.870","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93452","references":[{"url":"https://github.com/xerial/snappy-java","label":"disclosure@vulncheck.com"},{"url":"https://github.com/xerial/snappy-java/blob/v1.1.10.8/src/main/java/org/xerial/snappy/Snappy.java#L137","label":"disclosure@vulncheck.com"},{"url":"https://github.com/xerial/snappy-java/issues/732","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/snappy-java-through-1.1.10.8-buffer-overflow-in-snappy-compress","label":"disclosure@vulncheck.com"},{"url":"https://github.com/xerial/snappy-java/issues/732","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","exploit-available"],"epss":0.00493,"epssPercentile":0.41417,"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-18T19:59:57.835406Z"},"ingestedAt":"2026-09-17T23:31:20.691Z","slug":"CVE-2026-93452","body":"## Overview\n\nsnappy-java through 1.1.10.8 contains a buffer overflow vulnerability in Snappy.compress(ByteBuffer, ByteBuffer) that writes past the end of the destination buffer. Attackers can supply incompressible data that exceeds the destination buffer's remaining capacity, corrupting off-heap memory and causing JVM termination.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":207500,"id":"CVE-2026-93452","ts":1789764756523,"field":"exploit_available","old":"false","new":"true"}]}