CVE-2026-106451

A flaw was found in lz4-java. When extracting native libraries, the application writes temporary files to a shared directory using predictable file paths without exclusive file creation controls. A local attacker with access to the shared directory could exploit this race condition to replace the native library before it is loaded, potentially leading to arbitrary code execution with the privileges of the running application.

This vulnerability is rated as Moderate impact for Red Hat products because exploitation requires a local attacker to win a race condition during native library extraction within a shared temporary folder. An unauthorized user on the same host must predict and alter the extracted library file before the runtime dynamically loads it. In typical enterprise and containerized environments, isolated execution contexts and user-restricted temporary filesystems significantly restrict exposure to this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Configure affected Java applications to use a dedicated, private temporary directory rather than a world-writable directory such as /tmp.

1. Create a directory accessible only by the service account running the Java process:

mkdir -p /var/run/app-private-tmp
chmod 700 /var/run/app-private-tmp

2. Add the java.io.tmpdir system property to the application startup arguments or service environment:

-Djava.io.tmpdir=/var/run/app-private-tmp

Caveats: Applying this configuration change requires restarting the target Java application or service. Ensure that the configured directory is maintained across reboots with correct ownership and SELinux permissions.