CVE-2026-32829

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-32829
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-32829.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-32829
Aliases
Downstream
Related
Published
2026-03-20T00:49:12.893Z
Modified
2026-03-23T02:43:52.865606Z
Severity
  • 8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
lz4_flex: Decompression can leak information from uninitialized memory or reused output buffer
Details

lz4_flex is a pure Rust implementation of LZ4 compression/decompression. In versions 0.11.5 and below, and 0.12.0, decompressing invalid LZ4 data can leak sensitive information from uninitialized memory or from previous decompression operations. The library fails to properly validate offset values during LZ4 "match copy operations," allowing out-of-bounds reads from the output buffer. The block-based API functions (decompress_into, decompress_into_with_dict, and others when safe-decode is disabled) are affected, while all frame APIs are unaffected. The impact is potential exposure of sensitive data and secrets through crafted or malformed LZ4 input. This issue has been fixed in versions 0.11.6 and 0.12.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-201",
        "CWE-823"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32829.json"
}
References

Affected packages

Git / github.com/pseitz/lz4_flex

Affected ranges

Type
GIT
Repo
https://github.com/pseitz/lz4_flex
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6460047c0ba18bf4e3331894c8db220bc724a439
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.11.6"
        }
    ]
}
Type
GIT
Repo
https://github.com/pseitz/lz4_flex
Events
Introduced
975bfa7ac9583da879b5d7578b423232d84f69fe
Fixed
fa48c987a88df5059a49fe7519c028d6f2b8caf4
Database specific 
{
    "versions": [
        {
            "introduced": "0.12.0"
        },
        {
            "fixed": "0.12.1"
        }
    ]
}

Affected versions

0.*
0.12.0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-32829.json"