{"vulnerability": "CVE-2026-106451", "sightings": [{"uuid": "ed8e48dc-fe6a-48d7-bc67-c4054733c697", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-106451", "type": "seen", "source": "https://gist.github.com/alon710/d7378600839e77d95252a532542c1473", "content": "# CVE-2026-106451: CVE-2026-106451: Local Privilege Escalation via JNI Extraction TOCTOU in lz4-java\n\n> **CVSS Score:** 7.3\n> **Published:** 2026-10-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-106451\n\n## Summary\nA local privilege escalation and code execution vulnerability exists in the yawkat fork of lz4-java when extracting its bundled JNI shared library into the system temporary directory. Predictable path derivation and lack of exclusive file creation flags allow a local attacker to hijack library loading via a race condition.\n\n## TL;DR\nA local attacker can exploit a TOCTOU race condition and insecure temporary file creation in lz4-java's JNI loader to execute arbitrary code as the victim JVM user.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-367 (TOCTOU) / CWE-377 (Insecure Temporary File)\n- **Attack Vector**: Local\n- **CVSS Score**: 7.3 (High)\n- **EPSS Score / Percentile**: 0.00083 / 0.21%\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- lz4-java\n- JVM applications running on multi-user systems\n- **lz4-java**: >= 1.7.0, < 1.11.4 (Fixed in: `1.11.4`)\n\n## Mitigation\n\n- Upgrade lz4-java to version 1.11.4 or higher\n- Configure a private temporary directory for the JVM using -Djava.io.tmpdir\n- Enable operating system-level symbolic link protections\n\n**Remediation Steps:**\n1. Identify vulnerable uses of lz4-java in project dependencies.\n2. Update Maven/Gradle configuration to pull version 1.11.4.\n3. Rebuild and deploy the patched application.\n4. If patching is delayed, append '-Djava.io.tmpdir=/secure/private/path' to JVM start options.\n\n## References\n\n- [GitHub Security Advisory GHSA-mcr4-qmvw-px4g](https://github.com/yawkat/lz4-java/security/advisories/GHSA-mcr4-qmvw-px4g)\n- [Official Fix Commit](https://github.com/yawkat/lz4-java/commit/7a48b7f6b8099b9dab6541e4ac2ee0979dc55aa3)\n- [Official Fix Release](https://github.com/yawkat/lz4-java/releases/tag/v1.11.4)\n- [NVD Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-106451)\n- [CVE Project Record](https://www.cve.org/CVERecord?id=CVE-2026-106451)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-106451) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-08T13:30:30.000000Z"}]}