Is there a public PoC exploit available for CVE-2026-14686?

Yes, a public proof-of-concept exploit is available for CVE-2026-14686. Prioritise patching immediately. EPSS: 0.2%.

HdrHistogram CVE-2026-14686

Q: What is the CVSS score of CVE-2026-14686?

CVE-2026-14686 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-41708 LOW

Incorrect Comparison (CWE-697)

2026-07-05 VulDB

GHSA-pcmr-4mmx-225x

Java Information Disclosure Hdrhistogram

1.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

1.9 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.3 LOW

Local-only access (AV:L), low privileges to influence input (PR:L), integrity-only impact (I:L) with no confidentiality or availability effect.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 05, 2026 - 01:22 NVD

MEDIUM LOW

CVSS changed

Jul 05, 2026 - 01:22 NVD

4.8 (MEDIUM) 1.9 (LOW)

Analysis Generated

Jul 05, 2026 - 00:42 vuln.today

DescriptionCVE.org

A vulnerability was found in HdrHistogram up to 2.2.2. This issue affects the function org.HdrHistogram.DoubleHistogram.recordValue of the file src/main/java/org/HdrHistogram/DoubleHistogram.java of the component Range Check. Performing a manipulation results in incorrect comparison. The attack is only possible with local access. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Incorrect comparison in HdrHistogram's DoubleHistogram.recordValue() range check allows a local, low-privileged attacker to manipulate histogram integrity by recording out-of-range values that bypass the bounds check. Versions up to and including 2.2.2 are affected. No public exploit identified at time of analysis - publicly available exploit code exists, and the project maintainer has not responded to the responsible disclosure, leaving the vulnerability unpatched.

Technical ContextAI

HdrHistogram is a Java library designed for recording latency and performance distributions with high dynamic range and configurable precision. The affected component is the Range Check logic inside org.HdrHistogram.DoubleHistogram.recordValue() in src/main/java/org/HdrHistogram/DoubleHistogram.java. CWE-697 (Incorrect Comparison) indicates the bounds-checking predicate evaluates incorrectly - likely using the wrong operator, comparing the wrong operands, or suffering from a floating-point comparison edge case - allowing values that should be rejected to be accepted and recorded. The CPE (cpe:2.3:a:n/a:hdrhistogram:*:*:*:*:*:*:*:*) confirms the scope is the standalone HdrHistogram library through version 2.2.2. Because DoubleHistogram internally uses a 64-bit floating-point representation, floating-point precision boundaries may interact with integer-range assumptions in the check.

RemediationAI

No vendor-released patch identified at time of analysis - the project maintainer had not responded to the GitHub issue report as of disclosure. As a compensating control, callers of DoubleHistogram.recordValue() should implement an explicit application-layer bounds check before invoking the method, validating that the value falls within the expected histogram range (e.g., between the configured lowestDiscernibleValue and the histogram's configured highestTrackableValue). This adds a small per-call overhead but prevents incorrect values from silently entering the histogram. Alternatively, consider migrating to HDR Histogram's integer-based Histogram class where applicable, as the DoubleHistogram wrapper introduces additional floating-point range logic. Monitor the upstream GitHub repository at https://github.com/HdrHistogram/HdrHistogram/ and the issue thread at https://github.com/HdrHistogram/HdrHistogram/issues/222 for a patched release. If a patch is eventually released, upgrade past version 2.2.2.