CVE-2026-106451
Description
A flaw was found in lz4-java. When extracting native libraries, the application writes temporary files to a shared directory using predictable file paths without exclusive file creation controls. A local attacker with access to the shared directory could exploit this race condition to replace the native library before it is loaded, potentially leading to arbitrary code execution with the privileges of the running application.
Statement
This vulnerability is rated as Moderate impact for Red Hat products because exploitation requires a local attacker to win a race condition during native library extraction within a shared temporary folder. An unauthorized user on the same host must predict and alter the extracted library file before the runtime dynamically loads it. In typical enterprise and containerized environments, isolated execution contexts and user-restricted temporary filesystems significantly restrict exposure to this flaw.
Mitigation
Configure affected Java applications to use a dedicated, private temporary directory rather than a world-writable directory such as /tmp.
1. Create a directory accessible only by the service account running the Java process:
bash
mkdir -p /var/run/app-private-tmp
chmod 700 /var/run/app-private-tmp
2. Add the `java.io.tmpdir` system property to the application startup arguments or service environment:
-Djava.io.tmpdir=/var/run/app-private-tmp
Caveats:
Applying this configuration change requires restarting the target Java application or service. Ensure that the configured directory is maintained across reboots with correct ownership and SELinux permissions.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | High | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data
On some operating systems, the fact that the temporary file exists may be apparent to any user with sufficient privileges to access that directory. Since the file is visible, the application that is using the temporary file could be known. If one has access to list the processes on the system, the attacker has gained information about what the user is doing at that time. By correlating this with the applications the user is running, an attacker could potentially discover what a user's actions are. From this, higher levels of security could be breached.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
