CVE-2019-17543

HighCVSS 8.1

Published: 14/10/2019(UTC)Updated: 14/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

9.12%

95th percentile - higher than 95% of all known CVEs

Summary

LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. This issue can also lead to data corruption. The vendor states that only a few specific/uncommon usages of the API are at risk.

Risk Assessment

Potential remote code execution or data corruption in applications using LZ4 in specific ways.

Recommendation

Update the LZ4 library to version 1.9.2 or later and review API usage for risk.

Other vulnerabilities in LZ4

CVE-2021-3520Critical
There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well.

Original NVD description (English source)

LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states "only a few specific / uncommon usages of the API are at risk."

Vulnerability data from NVD (NIST) · CISA KEV · EPSS