ZeroDay Findings
Sign inSign up

Findings

CVE-2019-17543

LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input.

Published Oct 14, 2019 · updated Oct 14, 2026 · lz4 project lz4

LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states "only a few specific / uncommon usages of the API are at risk."

Timeline

Detection, updates, and resolution for this record.

  1. Oct 14, 2019 · NIST NVD

    Detected

    LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states "only a few specific / uncommon usages of the API are at risk."

  2. Oct 14, 2026 · NIST NVD

    Updated

    LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states "only a few specific / uncommon usages of the API are at risk."

Affected

  • cpe lz4 project/lz4version unspecified

Sources

  • CVE.orgVulnerability recordCVE-2019-17543

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2019-17543

    30-day exploitation probability 9.1%

    first.org
  • NIST NVDVulnerability recordCVE-2019-17543

    LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states "only a few specific / uncommon usage

    nvd.nist.gov

References