CVE-2026-106451

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-07

Assigner: GitHub, Inc.

Description

yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load() uses File.createTempFile to create an exclusive temporary .lck file but derives the native-library path by removing the suffix, then FileOutputStream opens that predictable path without exclusive creation, allowing another local user with access to the same shared temporary directory to create or replace the library file before System.load() uses it. Successful exploitation depends on shared-directory permissions, host protections, and winning the race, and can execute native code as the victim; hardened systems may instead cause library loading to fail and fall back to Java implementations. Configurations using a system library, a private java.io.tmpdir, or Java-only implementations are not affected. This issue is fixed in version 1.11.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106451

EUVD

EUVD-2026-93868

Affected Vendors & Products

Vendor	Product	Version / Range
yawkat	lz4-java	< 1.11.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-377	Creating and using insecure temporary files can leave application and system data vulnerable to attack.
CWE-367	The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

Executive Summary

This vulnerability affects yawkat LZ4 Java library versions 1.7.0 to 1.11.4. It involves a race condition where a temporary lock file is created predictably, allowing a local attacker to replace the library file before it is loaded. This could lead to arbitrary code execution with the permissions of the user running the application.

Detection Guidance

This vulnerability is specific to yawkat LZ4 Java versions 1.7.0 to 1.11.4 and involves insecure temporary file handling. Detection requires checking the installed version of the LZ4 Java library. Use commands like 'find / -name "lz4-java*.jar" 2>/dev/null' to locate the library, then inspect its version metadata or manifest file for the version number.

Impact Analysis

If you use a vulnerable version of the LZ4 Java library in a shared environment, an attacker with local access could exploit this to execute malicious code on your system. This could result in data theft, system compromise, or further network attacks depending on your environment.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized local users to execute native code on a system. If exploited, it may lead to unauthorized data access or modification, violating confidentiality and integrity requirements under these regulations.

Mitigation Strategies

Upgrade the yawkat LZ4 Java library to version 1.11.4 or later immediately. If upgrading is not possible, consider replacing the library with a system library, private java.io.tmpdir, or a Java-only implementation that is not affected by this issue.

Hi! I’m here to help you understand CVE-2026-106451. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70