Read the docs
TI-2019-08927 Aliases CVE-2019-11922GHSA-w77f-wv46-4vcx

Race condition in Meta Zstandard

Priority LOW 38CWE-362Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

A race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.

Why it matters now

EPSS 0.01419 72nd percentileScored 2026-11-07
Fix Fixed Zstandard (Facebook): 1.3.8

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MetaZstandard1.3.8; before 1.3.81.3.8Patch availableCNA
  • Zstandard VendorMeta Affected 1.3.8; before 1.3.8 Fixed in 1.3.8 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:facebook:zstandard:*:*:*:*:*:*:*:*before 1.3.8VulnerableMeta
  • cpe:2.3:a:facebook:zstandard:*:*:*:*:*:*:*:* Versions before 1.3.8 Vulnerable ·Meta

Remediation

  • Fix · CNA Zstandard (Facebook) Fixed in 1.3.8

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 3 products
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Software Collections

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-11922
  2. 2026-10-03 Alias added: GHSA-w77f-wv46-4vcx

References

Patch 1

Advisory 5

Other 1

  • TI-2022-04490 Uncontrolled resource consumption in zstd CVSS 3.1HIGH 7.5
  • TI-2021-06348 Incorrect default permissions in Meta Zstandard CVSS 3.1MEDIUM 5.5
  • TI-2021-06349 Incorrect default permissions in Meta Zstandard CVSS 3.1MEDIUM 4.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences