CVE-2026-32829
lz4_flex is a pure Rust implementation of LZ4 compression/decompression. In versions 0.11.5 and below, and 0.12.0, decompressing invalid LZ4 data can leak sensitive information from uninitialized memory or from previous decompression operations. The library fails to properly validate offset values during LZ4 "match copy operations," allowing out-of-bounds reads from the output buffer. The block-based API functions (`decompress_into`, `decompress_into_with_dict`, and others when `safe-decode` is disabled) are affected, while all frame APIs are unaffected. The impact is potential exposure of sensitive data and secrets through crafted or malformed LZ4 input. This issue has been fixed in versions 0.11.6 and 0.12.1.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.2
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.61%
- CWE
- CWE-201, CWE-823
- Published
- 2026-03-20
- Last modified
- 2026-09-04
Affected products
- PSeitz lz4_flex
- PSeitz lz4_flex
Weakness type
Related vulnerabilities
- CVE-2026-81804 — WordPress ZHBackup – Backup, Restore & Migration plugin <= 2.4.2 - Sensitive Data Exposure vulnerability
- CVE-2026-78374 — Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension < 2.3.0
- CVE-2026-78303 — Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in Booking Requests in SP Property < 4.1.4
- CVE-2026-87015 — Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication
- CVE-2026-65812 — Microsoft Teams for Android Information Disclosure Vulnerability
- CVE-2026-86505 — In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to...
- CVE-2026-86497 — In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed...
- CVE-2026-85307 — WordPress KP Agent Ready plugin < 1.2.08 - Sensitive Data Exposure vulnerability