ZeroDay Findings
Sign inSign up

Findings

CVE-2021-3520

There's a flaw in lz4.

Published Jun 2, 2021 · updated Oct 14, 2026 · lz4 project lz4

There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Jun 2, 2021 · NIST NVD

    Detected

    There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well.

  2. Oct 14, 2026 · NIST NVD

    Updated

    There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well.

Affected

  • cpe lz4 project/lz4version unspecified
  • cpe netapp/active iq unified managerversion unspecified
  • cpe netapp/cloud backupversion unspecified
  • cpe netapp/ontap select deploy administration utilityversion unspecified
  • cpe oracle/communications cloud native core policy1.14.0
  • cpe oracle/zfs storage appliance kit8.8
  • cpe splunk/universal forwarderversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2021-3520

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2021-3520

    30-day exploitation probability 3.4%

    first.org
  • NIST NVDVulnerability recordCVE-2021-3520

    There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw

    nvd.nist.gov

References