PT-2025-43426 · Lz4 · Lz4

Published 2025-10-23 · Updated 2025-10-30 · CVE-2025-62813

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions LZ4 versions through 1.10.0

Description LZ4 through version 1.10.0 contains a flaw that could allow attackers to cause a denial of service (application crash) or potentially achieve other unspecified impacts when processing untrusted LZ4 frames. Specifically, the LZ4F createCDict advanced function in lib/lz4frame.c does not properly handle NULL checks.

Recommendations Update to a version of LZ4 newer than 1.10.0.

Fix

DoS

Weakness Enumeration

CWE-158

Related Identifiers

CVE-2025-62813

ECHO-7C08-CB6B-2953

OPENSUSE-SU-2025:15675-1

OPENSUSE-SU-2025:15678-1

OPENSUSE-SU-2025:15679-1

OPENSUSE-SU-2025:15688-1

Affected Products

Lz4

References · 17

• https://osv.dev/vulnerability/DEBIAN-CVE-2025-62813 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62813 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-62813 · Security Note
• https://osv.dev/vulnerability/CVE-2025-62813 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15679-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-62813 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15675-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15688-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-62813 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-62813 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15678-1 · Vendor Advisory
• https://github.com/lz4/lz4/commit/f64efec011c058bd70348576438abac222fe6c82 · Note
• https://github.com/lz4/lz4/pull/1593 · Note
• https://t.me/msrcreports/2223 · Telegram Post
• https://t.me/CVEtracker/35549 · Telegram Post