HdrHistogram CVE-2026-14685

Exploitation requires local access to the host running the JVM application that uses HdrHistogram. The attacker must have low OS-level privileges (PR:L per CVSS vector). The vulnerable code path is the recordValueWithCount function in AbstractHistogram.java, meaning exploitation is limited to contexts where this specific method is invoked with attacker-influenced Count values - typically only possible if the application exposes histogram recording to untrusted local callers or if the attacker can inject data into an application's metrics pipeline. There is no network-accessible attack surface (AV:L). Exploitation is further limited by the absence of confidentiality or availability impact; the outcome is restricted to low-integrity corruption of histogram state. No special non-default configuration is required beyond the library being present in the application's classpath.

The real-world risk of this vulnerability is very low. The CVSS 4.0 score of 1.9 accurately reflects the constrained impact: exploitation requires local system access with low privileges (AV:L/PR:L), produces only a low integrity violation on the vulnerable system (VI:L), and has no confidentiality or availability impact. There is no network-accessible attack surface. While a public proof-of-concept exists (E:P), the vulnerability is not in CISA KEV and EPSS data is unavailable from the provided intelligence. The combination of local-only access and limited impact means this is unlikely to be a prioritized target for opportunistic attackers. The primary concern is in high-assurance environments where metrics accuracy is safety- or compliance-critical (e.g., latency SLA tracking in financial or real-time systems), where corrupted histogram state could produce misleading performance data. No conflicting signals exist in the provided data; the low score and local vector are consistent with the described behavior.

A local attacker with low OS-level privileges on a host running a JVM application that embeds HdrHistogram calls recordValueWithCount with a crafted Count argument, causing the AbstractHistogram object to enter a corrupted state. The public proof-of-concept demonstrates this manipulation, meaning the technique is already documented and reproducible. The practical impact is silent corruption of histogram metrics, which could cause downstream monitoring or alerting systems to report incorrect latency or throughput data.