LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states "only a few specific / uncommon usages of the API are at risk."
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-lz4alma-upgrade-lz4-develalma-upgrade-lz4-libs | Aug 4, 2025 | Jul 15, 2025 | |
| Alpine Linux | alpine-linux-upgrade-lz4 | Mar 26, 2024 | Oct 14, 2019 | |
| Debian | debian-upgrade-lz4 | Jul 30, 2024 | Oct 14, 2019 | |
| Freebsd | freebsd-upgrade-package-mysql57-serverfreebsd-upgrade-package-mysql80-serverfreebsd-upgrade-package-mariadb103-serverfreebsd-upgrade-package-mariadb104-serverfreebsd-upgrade-package-mariadb105-server | Nov 4, 2022 | Jul 20, 2021 | |
| Huawei Euleros 2_0_sp2 | huawei-euleros-2_0_sp2-upgrade-lz4 | Dec 4, 2019 | Oct 14, 2019 | |
| Huawei Euleros 2_0_sp3 | huawei-euleros-2_0_sp3-upgrade-lz4 | Dec 18, 2019 | Oct 14, 2019 | |
| Huawei Euleros 2_0_sp5 | huawei-euleros-2_0_sp5-upgrade-lz4 | Dec 11, 2019 | Oct 14, 2019 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-lz4huawei-euleros-2_0_sp8-upgrade-lz4-develhuawei-euleros-2_0_sp8-upgrade-lz4-libs | Nov 28, 2019 | Oct 14, 2019 | |
| Nutanix Ahv | nutanix-ahv-upgrade-latest | Jun 5, 2026 | Oct 10, 2025 | |
| Oracle Mysql | mysql-upgrade-5_7_35mysql-upgrade-8_0_26 | Jun 15, 2026 | Oct 14, 2019 | |
| Oracle Solaris | oracle-solaris-11-4-upgrade-database-mysql-57-5-7-35-11-4-38-0-1-101-1oracle-solaris-11-4-upgrade-database-mysql-57-client-5-7-35-11-4-38-0-1-101-1oracle-solaris-11-4-upgrade-database-mysql-57-embedded-5-7-35-11-4-38-0-1-101-1oracle-solaris-11-4-upgrade-database-mysql-57-library-5-7-35-11-4-38-0-1-101-1oracle-solaris-11-4-upgrade-database-mysql-57-tests-5-7-35-11-4-38-0-1-101-1 | Nov 17, 2021 | Oct 14, 2019 | |
| Oracle_linux | — | oracle-linux-upgrade-lz4oracle-linux-upgrade-lz4-develoracle-linux-upgrade-lz4-libs | Jul 16, 2025 | Jul 17, 2019 |
| Redhat_linux | no-fix-redhat-rpm-packageredhat-upgrade-lz4redhat-upgrade-lz4-debuginforedhat-upgrade-lz4-debugsourceredhat-upgrade-lz4-develredhat-upgrade-lz4-libsredhat-upgrade-lz4-libs-debuginfo | Jul 9, 2025 | Oct 14, 2019 | |
| Rocky_linux | rocky-upgrade-lz4rocky-upgrade-lz4-debuginforocky-upgrade-lz4-debugsourcerocky-upgrade-lz4-develrocky-upgrade-lz4-libsrocky-upgrade-lz4-libs-debuginfo | Feb 5, 2026 | Jul 29, 2025 | |
| Suse | — | suse-upgrade-liblz4-1suse-upgrade-liblz4-1-32bitsuse-upgrade-liblz4-develsuse-upgrade-lz4 | Oct 30, 2019 | Oct 14, 2019 |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Oct 14, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub