CVE-2026-106451: Local Privilege Escalation via JNI Extraction TOCTOU in lz4-java

Vulnerability ID: CVE-2026-106451
CVSS Score: 7.3
Published: 2026-10-07

A local privilege escalation and code execution vulnerability exists in the yawkat fork of lz4-java when extracting its bundled JNI shared library into the system temporary directory. Predictable path derivation and lack of exclusive file creation flags allow a local attacker to hijack library loading via a race condition.

TL;DR

A local attacker can exploit a TOCTOU race condition and insecure temporary file creation in lz4-java's JNI loader to execute arbitrary code as the victim JVM user.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-367 (TOCTOU) / CWE-377 (Insecure Temporary File)
  • Attack Vector: Local
  • CVSS Score: 7.3 (High)
  • EPSS Score / Percentile: 0.00083 / 0.21%
  • Exploit Status: Proof-of-Concept
  • KEV Status: Not Listed

Affected Systems

  • lz4-java
  • JVM applications running on multi-user systems
  • lz4-java: >= 1.7.0, < 1.11.4 (Fixed in: 1.11.4)

Code Analysis

Commit: 7a48b7f

Avoid dynamic path derivation and use File.createTempFile directly for temporary shared libraries.

Mitigation Strategies

  • Upgrade lz4-java to version 1.11.4 or higher
  • Configure a private temporary directory for the JVM using -Djava.io.tmpdir
  • Enable operating system-level symbolic link protections

Remediation Steps:

  1. Identify vulnerable uses of lz4-java in project dependencies.
  2. Update Maven/Gradle configuration to pull version 1.11.4.
  3. Rebuild and deploy the patched application.
  4. If patching is delayed, append '-Djava.io.tmpdir=/secure/private/path' to JVM start options.

References

Read the full report for CVE-2026-106451 on our website for more details including interactive diagrams and full exploit analysis.