MEDIUM
CVE-2026-93451
CVSS
6.5
Description
snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompress*Array methods that allocate output arrays by dividing uncompressed length by element size but pass the undivided length to native code. Attackers controlling compressed input can cause misaligned length values to write past array bounds with attacker-controlled bytes, corrupting heap memory.
Weakness (CWE)
CWE-787
Out-of-bounds Write
EPSS Score
0.3%
Probability of exploitation in next 30 days
22.4th percentile
References
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.