yawkat lz4-java up to 1.11.3 Native Library Loading net.jpountz.util.Native.load temp file

Summaryinfo

A vulnerability classified as problematic has been found in yawkat lz4-java up to 1.11.3. This issue affects the function net.jpountz.util.Native.load of the component Native Library Loading. The manipulation leads to temp file. This vulnerability is traded as CVE-2026-106451. An attack has to be approached locally. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in yawkat lz4-java up to 1.11.3. It has been rated as problematic. This issue affects the function net.jpountz.util.Native.load of the component Native Library Loading. The manipulation with an unknown input leads to a temp file vulnerability. Using CWE to declare the problem leads to CWE-377. Creating and using insecure temporary files can leave application and system data vulnerable to attack. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load() uses File.createTempFile to create an exclusive temporary .lck file but derives the native-library path by removing the suffix, then FileOutputStream opens that predictable path without exclusive creation, allowing another local user with access to the same shared temporary directory to create or replace the library file before System.load() uses it. Successful exploitation depends on shared-directory permissions, host protections, and winning the race, and can execute native code as the victim; hardened systems may instead cause library loading to fail and fall back to Java implementations. Configurations using a system library, a private java.io.tmpdir, or Java-only implementations are not affected. This issue is fixed in version 1.11.4.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-106451 since 10/06/2026. The exploitation is known to be easy. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 1.11.4 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Programming Language Software

Vendor

• yawkat

Name

• lz4-java

Version

• 1.11.0
• 1.11.1
• 1.11.2
• 1.11.3

Website

• Product: https://github.com/yawkat/lz4-java/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion