There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade lz4Upgrade lz4-develUpgrade lz4-libs | May 4, 2022 | Jun 2, 2021 |
| Alpine Linux | — | Upgrade lz4 | Mar 26, 2024 | Jun 2, 2021 |
| Amazon_linux_2023 | — | Upgrade lz4-staticUpgrade lz4-debuginfoUpgrade lz4Upgrade lz4-libs-debuginfoUpgrade lz4-libsUpgrade lz4-debugsourceUpgrade lz4-devel | Feb 17, 2025 | Apr 28, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jun 2, 2021 |
| Centos_linux | — | Upgrade lz4-libs-debuginfoUpgrade lz4-libsUpgrade lz4-debuginfoUpgrade lz4-debugsourceUpgrade lz4-develUpgrade lz4 | Jun 30, 2021 | Jun 2, 2021 |
| Debian | — | Upgrade lz4 | May 13, 2021 | May 13, 2021 |
| Gentoo Linux | — | Upgrade app-arch/lz4. | Jun 24, 2024 | Jun 2, 2021 |
| Huawei Euleros 2_0_sp2 | — | Upgrade lz4 | Sep 16, 2021 | Jun 2, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade lz4 | Sep 29, 2021 | Jun 2, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade lz4-libsUpgrade lz4-develUpgrade lz4 | Sep 24, 2021 | Jun 2, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade lz4 | Sep 29, 2021 | Jun 2, 2021 |
| Oracle Solaris | — | Upgrade compress/lz4 to version 1.9.2-11.4.35.0.1.94.2 on Solaris 11.4 | Jul 21, 2021 | Jun 2, 2021 |
| Oracle_linux | — | Upgrade lz4-develUpgrade lz4-libsUpgrade lz4 | Jun 30, 2021 | Apr 28, 2021 |
| Redhat_linux | — | Upgrade lz4Upgrade lz4-libsNo solution existsUpgrade lz4-debuginfoUpgrade lz4-libs-debuginfoUpgrade lz4-debugsourceUpgrade lz4-devel | Jun 30, 2021 | Jun 2, 2021 |
| Rocky_linux | — | Upgrade lz4-debuginfoUpgrade lz4-libs-debuginfoUpgrade lz4-develUpgrade lz4-debugsourceUpgrade lz4-libsUpgrade lz4 | May 5, 2022 | Jun 2, 2021 |
| Splunk | — | Upgrade Splunk Universal Forwarder to version 8.1.14Upgrade Splunk Universal Forwarder to version 8.2.11Upgrade Splunk Enterprise to version 8.2.11Upgrade Splunk Universal Forwarder to version 9.0.5Upgrade Splunk Universal Forwarder to version 8.2.12Upgrade Splunk Enterprise to version 9.0.5Upgrade Splunk Universal Forwarder to version 9.0.6Upgrade Splunk Enterprise to version 9.1.1Upgrade Splunk Universal Forwarder to version 9.1.1Upgrade Splunk Enterprise to version 8.1.14Upgrade Splunk Enterprise to version 8.2.12Upgrade Splunk Enterprise to version 9.0.6 | Sep 30, 2025 | Jun 2, 2021 |
| Suse | — | Upgrade liblz4-1Upgrade lz4Upgrade liblz4-develUpgrade liblz4-1-32bit | May 15, 2021 | May 14, 2021 |
| Ubuntu | — | Upgrade liblz4-1Upgrade liblz4-1 (Ubuntu Pro) | May 27, 2021 | May 14, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 2, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub