Log in Start free

Vulnerability · Published Mar 20, 2026 · Assigned by GitHub_M

CVE-2026-32829lz4_flex: Decompression can leak information from uninitialized memory or reused output buffer

High 7.5

In plain English

A high-severity security flaw in lz4_flex from PSeitz. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.6%top 49.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

lz4_flex is a pure Rust implementation of LZ4 compression/decompression. In versions 0.11.5 and below, and 0.12.0, decompressing invalid LZ4 data can leak sensitive information from uninitialized memory or from previous decompression operations. The library fails to properly validate offset values during LZ4 "match copy operations," allowing out-of-bounds reads from the output buffer. The block-based API functions (`decompress_into`, `decompress_into_with_dict`, and others when `safe-decode` is disabled) are affected, while all frame APIs are unaffected. The impact is potential exposure of sensitive data and secrets through crafted or malformed LZ4 input. This issue has been fixed in versions 0.11.6 and 0.12.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13rust-lz4-flexno fix listedDEBIAN-CVE-2026-32829
Debian:14rust-lz4-flex0.13.0-1DEBIAN-CVE-2026-32829
Ubuntu:24.04:LTSrust-lz4-flexno fix listedUBUNTU-CVE-2026-32829
Ubuntu:25.10rust-lz4-flexno fix listedUBUNTU-CVE-2026-32829
Ubuntu:26.04:LTSrust-lz4-flexno fix listedUBUNTU-CVE-2026-32829
Ubuntu:26.10rust-lz4-flexno fix listedUBUNTU-CVE-2026-32829

Affected products (as reported)

VendorProductVersions
PSeitz lz4_flex < 0.11.6>= 0.12.0, < 0.12.1

Weakness: CWE-201, CWE-823 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References