CVE-2021-3520
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk88th percentile - higher than 88% of all known CVEs
Summary
There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well.
Risk Assessment
Potential application crash or out-of-bounds write, which could lead to availability issues and, in some cases, data leakage or modification.
Recommendation
Upgrade the lz4 library to a patched version and avoid processing untrusted files without proper validation.
Other vulnerabilities in lz4
Original NVD description (English source)
There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS