Loading story…
A high-severity vulnerability, tracked as CVE-2025-66566, was discovered in the lz4-java library, which provides LZ4 compression for Java applications. The flaw exists in the Java-based decompressor implementations up to version 1.10.0, where insufficient clearing of the output buffer allows remote attackers to read uninitialized memory by submitting specially crafted compressed input. This could potentially expose sensitive data if the output buffer is reused without being cleared. The vulnerability does not affect JNI-based implementations and has been addressed in version 1.10.1 of the library.
Security advisories highlight that the vulnerability is remotely exploitable and could impact any application using the affected versions of lz4-java for decompression tasks. No specific affected products have been listed yet, but the risk is significant for environments where buffer reuse is common. Users are advised to update to the fixed version to mitigate the risk of information leakage through this flaw.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Advisory information recommended upgrading to lz4-java 1.10.1 or later and ensuring output buffers are properly cleared. The disclosure also noted that JNI-based decompressor implementations are not affected.
A high-severity information disclosure flaw affecting yawkat lz4-java up to version 1.10.0 was disclosed. The bug stems from insufficient clearing of the output buffer in the Java safe decompressor, allowing crafted compressed input to expose prior buffer contents when buffers are reused.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A malicious backdoor was discovered in **XZ Utils**, a widely used compression library, and assigned **`CVE-2024-3094`**, raising urgent concerns about software supply chain compromise across Linux environments. The tampered code was introduced into upstream release tarballs for versions **5.6.0** and **5.6.1** and could enable unauthorized remote code execution by subverting authentication workflows in systems using affected `liblzma` packages, particularly where `sshd` was linked through `systemd` integrations. Security teams were urged to identify vulnerable builds, downgrade to trusted versions, and verify package provenance across development and production systems. The incident renewed attention on the broader risk posed by foundational open-source components becoming attack vectors, echoing the long-tail impact of major infrastructure flaws such as **`CVE-2021-44228`** in **Apache Log4j**. While unrelated technically, both cases underscored how deeply embedded dependencies can create outsized enterprise exposure when compromised. Organizations were advised to strengthen software bill of materials validation, monitor upstream package integrity, and accelerate patching and rollback procedures for critical third-party libraries.
Jul 12, 2026
**CVE-2026-41992** affects gzip 1.14 and earlier, causing an out-of-bounds memory access when one `gzip -d` process decompresses specially crafted LZW data followed by specially crafted LZH data. The apparent state-reuse flaw is currently understood to require processing two malicious files in a single invocation and is expected to enable an out-of-bounds read and program crash. Michał Majchrowicz and Elias Hasas reported the issue and supplied fixes; Paul Eggert published the disclosure. Organizations running affected gzip packages should apply the patch that clears the `left` and `right` arrays in `huf_decode_start()` or upgrade to gzip 1.15 when available. CentOS 9 security updates address CVE-2026-41992 alongside CVE-2026-41991. The advisory rates the issue as medium severity, while scanner metadata presents differing exploitability vectors; no known exploitation has been reported.
Aug 27, 2026
A newly disclosed **7-Zip** vulnerability, tracked as `CVE-2026-14266`, allows remote code execution via a heap-based buffer overflow in the handling of crafted **XZ chunked data**. An attacker can trigger the flaw if a user opens a malicious archive or is lured to content that delivers a specially crafted XZ payload, causing code to run with the privileges of the current user. The issue is considered significant because 7-Zip is widely deployed and the attack path can be readily paired with phishing or malicious attachments. The bug was reported by Landon Peng of Lunbun LLC through coordinated disclosure, and the Zero Day Initiative published advisory **`ZDI-26-444`** after the fix became available. **7-Zip version 26.02**, released on June 25, 2026, contains the patch, and reporting said no public proof-of-concept or in-the-wild exploitation had been confirmed at publication. The flaw was assigned a **CVSS 7.0** score, reflecting the need for user interaction and a relatively complex exploit path, and users were urged to update and avoid opening untrusted compressed files.
Jul 24, 2026