CVE-2026-106451 yawkat CVE debrief

Who should care

Defenders should assess exposure and prioritize remediation for vulnerable lz4-java versions. Roles: security teams, system administrators, Java developers. Deployment contexts: systems using lz4-java, shared temporary directories.

Why it matters

CVE-2026-106451 allows local users to replace native library files, potentially leading to native code execution or library loading failure. Defenders should assess exposure, prioritize remediation for vulnerable lz4-java versions, and verify system configurations.

• execute native code as victim user
• library loading failure and fallback to Java implementations on hardened systems
• require verification of affected versions and remediation

Technical summary

yawkat LZ4 Java is vulnerable to native library replacement due to predictable temporary file path. Successful exploitation requires shared-directory permissions, host protections, and winning the race. Configurations using a system library, a private java.io.tmpdir, or Java-only implementations are not affected. The vulnerability allows local users to replace native library files, potentially leading to native code execution or library loading failure. The issue is fixed in version 1.11.4. Defenders should assess exposure and prioritize remediation for vulnerable lz4-java versions.

Defensive priority

Assess exposure, prioritize remediation for vulnerable lz4-java versions

Recommended defensive actions

• Assess lz4-java version exposure and prioritize remediation
• Verify system library, java.io.tmpdir, and Java-only implementation configurations
• Update to version 1.11.4 or later
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Official CVE Program record and NVD detail page provide vulnerability metadata. Source item and references provide additional context. The CVE record was published on 2026-10-06T19:50:41.915Z and has not been modified since then. The vulnerability has a CVSS score of 7.3 and is classified as HIGH. The affected product is yawkat LZ4 Java, and the issue is fixed in version 1.11.4.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.