CVE-2026-106451: yawkat LZ4 Java insecure temporary file handling in native library loading

CVE-2026-106451 · Severity: high · CVSS 4 · Published 2026-10-06

LZ4 Java is a compression library used in Java applications. Versions 1.7.0 to 1.11.3 have a race condition in how they load native code that allows another local user to replace the library file with malicious code before it is loaded, potentially executing arbitrary code with the victim's privileges. This risk only affects systems using shared temporary directories without special protections.

Technologies: at.yawk.lz4:lz4-java (Maven), org.lz4:lz4-java (Maven), Yawkat LZ4 Java. Vendors: Maven, Yawkat.

Quick answers

Is CVE-2026-106451 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-106451 being exploited in the wild.
How severe is CVE-2026-106451?
High severity, with a CVSS score of 4, published 6 October 2026.
Which products and versions are affected?
at.yawk.lz4:lz4-java (Maven) <= 1.11.3, ECOSYSTEM:introduced=0,fixed=1.11.4; org.lz4:lz4-java (Maven) >= 1.7.0, <= 1.8.1, ECOSYSTEM:introduced=1.7.0,last_affected=1.8.1; Yawkat LZ4 Java 1.7.0 to 1.11.3.
Is there a fix for CVE-2026-106451?
Yes. at.yawk.lz4:lz4-java (Maven): upgrade to 1.11.4 or later. Until then: Use a private java.io.tmpdir not shared with other users, or deploy systems with hardened temp directory permissions that prevent symlink attacks and file replacement.</anigation> </invoke> Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-106451 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-106451?
Check whether you run at.yawk.lz4:lz4-java (Maven), org.lz4:lz4-java (Maven) or Yawkat LZ4 Java at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • at.yawk.lz4:lz4-java (Maven): upgrade to 1.11.4 or later
    # set at.yawk.lz4:lz4-java to 1.11.4 in your pom.xml or build.gradle

Use a private java.io.tmpdir not shared with other users, or deploy systems with hardened temp directory permissions that prevent symlink attacks and file replacement.</anigation> </invoke>

Technical details

The vulnerability exists in net.jpountz.util.Native.load(), which creates an exclusive temporary .lck file but then derives a predictable path by removing the suffix and opens it via FileOutputStream without exclusive file creation. An attacker with access to the shared temp directory can create or replace the library file before System.load() executes it, achieving arbitrary native code execution if they win the race condition. Successful exploitation depends on shared temp directory permissions, host protections, and timing; hardened systems or those using private java.io.tmpdir or Java-only implementations are not affected.

Affected products

  • yawkat LZ4 Java 1.7.0 to 1.11.3

Identifiers

  • CVE-2026-106451
  • GHSA-mcr4-qmvw-px4g

Timeline

  • 2026-10-06: disclosed
  • 2026-09-25: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.