snappy-java (xerial) through 1.1.10.8 has an out-of-bounds write in Snappy.compress(ByteBuffer, ByteBuffer) when incompressible input exceeds the destination ByteBuffer remaining capacity. A remote attacker can trigger off-heap memory corruption leading to JVM termination (DoS). Mitigate by upgrading past 1.1.10.8 or ensuring output buffers are sized for worst-case expansion.