lz4-java up to 1.8.0 out-of-bounds

Summaryinfo

A vulnerability classified as critical has been found in lz4-java up to 1.8.0. This affects an unknown function. Performing a manipulation results in out-of-bounds. This vulnerability is cataloged as CVE-2025-12183. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in lz4-java up to 1.8.0. This affects some unknown processing. The manipulation with an unknown input leads to a out-of-bounds vulnerability. CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via untrusted compressed input.

It is possible to read the advisory at sites.google.com. This vulnerability is uniquely identified as CVE-2025-12183 since 10/24/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 297856 (RHEL 9 : Red Hat JBoss Enterprise Application Platform 8.1.4 (RHSA-2026:1871)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.8.1 eliminates this vulnerability. The upgrade is hosted for download at github.com.

The vulnerability is also documented in the databases at Tenable (297856), EUVD (EUVD-2025-199880) and CERT Bund (WID-SEC-2026-0164). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• IBM Java SDK
• Debian Linux
• IBM Tivoli Monitoring
• Amazon Linux 2
• IBM Power Hardware Management Console
• Open Source OpenJDK
• Red Hat Enterprise Linux
• Ubuntu Linux
• IBM WebSphere Application Server
• SUSE Linux
• IBM Tivoli Netcool/OMNIbus
• Oracle Linux
• IBM Tivoli Business Service Manager
• IBM TXSeries
• IBM License Metric Tool
• Hitachi Ops Center
• Hitachi Configuration Manager
• IBM MQ
• Dell Data Protection Advisor
• IBM Rational Business Developer
• SUSE openSUSE
• RESF Rocky Linux
• IBM App Connect Enterprise
• IBM InfoSphere Information Server
• Azul Zulu
• Hitachi Command Suite
• IBM Sterling Connect:Direct
• IBM WebSphere Service Registry and Repository
• Oracle Java SE
• Oracle GraalVM
• Amazon Corretto
• Tenable Security Nessus Network Monitor
• IBM Integration Bus
• Dell NetWorker
• Dell Secure Connect Gateway
• IBM DataPower Gateway
• IBM Semeru Runtime
• Dell ECS

Productinfo

Type

• Programming Language Software

Name

• lz4-java

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion