{"id":"CVE-2026-32829","aliases":["GHSA-vvp9-7p8x-rfvv","RUSTSEC-2026-0041"],"url":"https://o3.security/vulnerability/CVE-2026-32829","summary":"lz4_flex: Decompression can leak information from uninitialized memory or reused output buffer","details":"### Summary\nDecompressing invalid LZ4 data can leak data from uninitialized memory, or can leak content from previous decompression operations when reusing an output buffer.\n\n### Details\nThe LZ4 block format defines a \"match copy operation\" which duplicates previously written data or data from the user-supplied dict. The position of that data is defined by an _offset_. The data is copied within the output buffer from the _offset_ to the current output position.\nHowever, lz4_flex did not properly detect invalid and out-of-bounds _offset_ values properly, causing it to copy uninitialized data from the output buffer.\n\nOnly the block based API functions are affected: \n`lz4_flex::block::{decompress_into, decompress_into_with_dict}`\n\nWhen safe-decode is disabled _additionally_ these functions are affected\n`lz4_flex::block::{decompress, decompress_with_dict, decompress_size_prepended, decompress_size_prepended_with_dict}`\n\nAll `frame` APIs are _not_ affected.\n\nThere are two affected use cases:\n- decompressing LZ4 data with the `unsafe` implementation (`safe-decode` feature flag disabled, which is enabled by default):\ncan leak content of uninitialized memory as decompressed result\n- decompressing LZ4 data into a reused, user-supplied `output` buffer (affects the `safe-decode` feature as well):\ncan leak the previous contents of the output buffer as decompressed result\n\n### Impact\nLeakage of data from uninitialized memory or content from previous decompression operations, possibly revealing sensitive information and secrets.\n\n### Mitigation\nlz4_flex 0.12.1 and 0.11.6 fixes this issue without requiring changes in user code.\n\nIf you cannot upgrade, you can mitigate this vulnerability by zeroing the output buffer before calling `block::decompress_into` or  `block::decompress_into_with_dict` (only block based API is affected, frame API is not affected). Additionally the the `safe-decode` feature flag should be enabled.","published":"2026-03-20T00:49:12.893Z","modified":"2026-10-28T02:30:31.929742261Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"lz4_flex","fixedVersion":"0.11.6"},{"ecosystem":"crates.io","name":"lz4_flex","fixedVersion":"0.12.1"}],"fix":{"url":"https://github.com/PSeitz/lz4_flex/commit/055502ee5d297ecd6bf448ac91c055c7f6df9b6d","label":"PSeitz/lz4_flex@055502e"},"references":[{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32829.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11800"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16354"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19712"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22862"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-32829"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32829.json"},{"type":"ADVISORY","url":"https://github.com/PSeitz/lz4_flex/security/advisories/GHSA-vvp9-7p8x-rfvv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32829"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0041.html"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2448271"},{"type":"FIX","url":"https://github.com/PSeitz/lz4_flex/commit/055502ee5d297ecd6bf448ac91c055c7f6df9b6d"},{"type":"PACKAGE","url":"https://github.com/PSeitz/lz4_flex"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:31.929742261Z"}}