lz4-java RCE Vulnerability CVE-2026-106451 Advisory and Fix Details

Vulnerability Overview When the system-level is not installed, extracts the bundled native library to and loads it via . The path to the extracted library is predictable before it is created, and the library file is opened without exclusive creation. Other local users who can write to the same temporary directory can pre-create this file and control the code being loaded. Affected Versions Affected Versions: - (Maven) = 1.7.0, < 1.8.1 Severity: Low CVE ID: CVE-2026-106451 Remediation Fixed Version: 1.11.4 Patch Details: - The native library is now extracted to a file created using , which has a random name and is created exclusively. - The file is no longer needed because the file is created exclusively. - The startup cleanup process removes temporary files (including files) left behind by older versions that are more than one hour old. Workarounds for Older Versions: - Set to a directory writable only by the application user. - Or install in . POC Code Additional Information Weaknesses: - CWE-367 - CWE-377 Description: - In a shared, world-writable temporary directory, another user can wait for the file and race for the corresponding library file. If they win the race, they own the file. The victim then writes to the attacker-owned file, which the attacker can overwrite again before . Exploitation Conditions: - Depends on host settings: - If , the attacker can pre-create a world-writable file whose code is subsequently loaded into the victim's JVM. - If (the default setting for most systems), the victim's open call fails. The library then fails to load via the Java implementation, so the attacker can only cause a denial of service. - There are no sticky bits or shared directories in containers; these settings are exploitable. Impact: - Local users who can write to the same temporary directory containing the bundled JNL library used by the victim process may be able to execute code as the victim. - Exploitation requires a shared temporary directory, host settings that allow it, and winning the race condition. Inapplicability: - This behavior does not apply if is found in , if is private (e.g., system-level or per-user temporary directory), or if the Java implementation is used exclusively.

Goal Reached Thanks to every supporter — we hit 100%!

lz4-java RCE Vulnerability CVE-2026-106451 Advisory and Fix Details

More from this source