CVE-2021-3520

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-06-02 · updated 2026-10-14
Weakness: CWE-190

Description

There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well.

Affected products

Lz4 Project Lz4: from 1.8.3 before 1.9.4 — fixed in 1.9.4
Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
NetApp Cloud Backup: all versions
NetApp ONTAP Select Deploy administration utility: all versions
Oracle Communications Cloud Native Core Policy: 1.14.0
Oracle Corporation Oracle ZFS Storage Appliance Kit: 8.8
Splunk Universal Forwarder: from 8.2.0 before 8.2.12; from 9.0.0 before 9.0.6; 9.1.0 — fixed in 8.2.12, 9.0.6

How to fix

Upgrade to a fixed version: Lz4 Project Lz4 1.9.4; Splunk Universal Forwarder 8.2.12, 9.0.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-3520 or the next vulnerability affects your stack