EUVD-2026-93868
GHSA-mcr4-qmvw-px4g
Severity by source
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector (shared tmpdir) gives AV:L; the timing race and required shared-dir permissions justify AC:H; a local account is needed so PR:L; success yields native code execution with full C/I/A in the victim process.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
4Blast Radius
ecosystem impact- 120 maven packages depend on at.yawk.lz4:lz4-java (5 direct, 115 indirect)
- 65 maven packages depend on org.lz4:lz4-java (17 direct, 48 indirect)
Ecosystem-wide dependent count for version 1.11.4 and other introduced versions.
DescriptionCVE.org
yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load() uses File.createTempFile to create an exclusive temporary .lck file but derives the native-library path by removing the suffix, then FileOutputStream opens that predictable path without exclusive creation, allowing another local user with access to the same shared temporary directory to create or replace the library file before System.load() uses it. Successful exploitation depends on shared-directory permissions, host protections, and winning the race, and can execute native code as the victim; hardened systems may instead cause library loading to fail and fall back to Java implementations. Configurations using a system library, a private java.io.tmpdir, or Java-only implementations are not affected. This issue is fixed in version 1.11.4.
Articles & Coverage 1
AnalysisAI
Local authenticated attackers who share a writable Java temporary directory with a victim JVM can exploit a time-of-check/time-of-use race in lz4-java 1.7.0 through 1.11.3 to replace the native LZ4 library extracted by net.jpountz.util.Native.load(), potentially executing native code with the victim's privileges. The vulnerability is local-only and requires winning a race against native-library extraction, plus a shared java.io.tmpdir and native binding use; hardened configurations may instead fail loading and fall back to Java implementations. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) an authenticated local user who shares a writable temporary directory with the victim - i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a local TOCTOU race condition (CWE-367) in lz4-java's native-library extraction, scored CVSS 4.0 7.3. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade lz4-java to 1.11.4 or later; the vendor advisory is at https://github.com/yawkat/lz4-java/security/advisories/GHSA-mcr4-qmvw-px4g and the fixed release at https://github.com/yawkat/lz4-java/releases/tag/v1.11.4. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Java workload that bundles lz4-java in the affected range 1.7.0 through 1.11.3 using SBOM or dependency scanning across Maven/Gradle builds, fat JARs, container images, and CI runners, and flag any JVM process whose java.io.tmpdir is writable and shared across users or tenants; where such sharing exists, immediately move affected processes to private, per-user or per-process temporary directories with restrictive permissions, and disable native LZ4 binding so the library falls back to Java implementations as described in the technical details. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today