PT-2026-25910 · Lz4 Flex · Lz4 Flex

Marcono1234 · Published 2026-01-01 · Updated 2026-03-20 · CVE-2026-32829

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions lz4 flex versions 0.11.5 and below and 0.12.0

Description lz4 flex, a Rust implementation of LZ4 compression/decompression, contains a flaw where decompressing invalid LZ4 data can lead to information disclosure. Specifically, the library does not properly validate offset values during LZ4 "match copy operations," potentially causing out-of-bounds reads from the output buffer. This can result in the leakage of sensitive data from uninitialized memory or from previous decompression operations when reusing an output buffer. The block-based API functions (decompress into, decompress into with dict, and others when safe-decode is disabled) are affected, while frame APIs are not. The issue stems from improper validation of offset values during decompression, allowing the copying of data from outside the initialized portion of the output buffer. This can occur in two scenarios: when using the unsafe implementation (safe-decode feature flag disabled) and when decompressing into a reused output buffer.

Recommendations lz4 flex versions prior to 0.11.6 are affected. lz4 flex version 0.12.0 is affected. Upgrade to lz4 flex version 0.11.6 or 0.12.1 to resolve the issue. If upgrading is not possible, zero the output buffer before calling lz4 flex::block::decompress into or lz4 flex::block::decompress into with dict. Enable the safe-decode feature flag as a mitigation.

Exploit

Fix

Weakness Enumeration

CWE-201

CWE-823

Related Identifiers

CVE-2026-32829

GHSA-VVP9-7P8X-RFVV

RUSTSEC-2026-0041

Affected Products

Lz4 Flex

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32829.json · Exploit
• https://github.com/PSeitz/lz4_flex/security/advisories/GHSA-vvp9-7p8x-rfvv · Vendor Advisory
• https://github.com/PSeitz/lz4_flex/commit/055502ee5d297ecd6bf448ac91c055c7f6df9b6d · Patch
• https://cve.org/CVERecord?id=CVE-2026-32829 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-32829 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-32829 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32829 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32829 · Security Note
• https://ubuntu.com/security/CVE-2026-32829 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vvp9-7p8x-rfvv · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2026-0041 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-32829 · Vendor Advisory
• https://github.com/PSeitz/lz4_flex · Note
• https://github.com/advisories/GHSA-vvp9-7p8x-rfvv · Note
• https://twitter.com/CVEnew/status/2034841482818199851 · Twitter Post