HdrHistogram CVE-2026-14686

Exploitation requires local access to the system or process where the HdrHistogram library is in use - remote exploitation is not possible per AV:L. The attacker must have low-level privileges (PR:L) sufficient to influence the values passed to DoubleHistogram.recordValue(), either by controlling application input, injecting into a shared data stream, or directly interacting with the JVM process. The vulnerability is specific to the DoubleHistogram subclass; applications using only the integer-based Histogram class are not affected. No special non-default configuration is required beyond the use of DoubleHistogram. Limiting factors: local access is mandatory, the impact is restricted to integrity of histogram data (not code execution), and exploitation produces observable data anomalies rather than silent privilege escalation.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N, score 4.8) consistently characterizes this as a low-severity, local-only integrity issue requiring low privileges. There is no confidentiality or availability impact. The vulnerability is NOT in the CISA KEV catalog, meaning no confirmed active exploitation in the wild. However, publicly available exploit code exists (E:P in the CVSS 4.0 supplemental metrics and confirmed by the GitHub issue reference), lowering the bar for abuse. The practical real-world risk is limited: an attacker must already have local access and the ability to call into the JVM process or influence input values fed to recordValue(). The primary concern is data integrity corruption in monitoring, latency-tracking, or SLO-reporting systems that rely on HdrHistogram, which could mask performance regressions or produce misleading operational dashboards. The tags list 'Information Disclosure', which conflicts with the CVSS showing VC:N - this likely reflects a tagging ambiguity from the source (VulDB) rather than a confirmed confidentiality impact; treat that tag with low confidence.

A local user or a process running with low privileges on a shared JVM application host crafts a specific floating-point value that passes the flawed range comparison inside DoubleHistogram.recordValue(). When the application (e.g., a Kafka broker or latency monitoring service) records this value, the histogram's internal state is corrupted, causing reported latency percentiles or throughput metrics to be skewed or incorrect. A publicly available proof-of-concept hosted in the GitHub issue tracker demonstrates the triggering input.