Every CVE Search/ Get API key

CVE-2019-17543

LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to...

8.1 HighFix available

CVE-2019-17543 is a high vulnerability (CVSS 8.1) in Lz4 Project Lz4, published October 14, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 10.5%, the 95th percentile. Fixed in lz4 1.9.1-r1.

LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states "only a few specific / uncommon usages of the API are at risk."

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

10.5%Up 9.8 points since Sep 1, 2023
90%50%10%1%

What each source reports

NVD Score used 8.1

LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states "only a few specific / uncommon usages of the API are at risk."

Record
CVE-2019-17543
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-787
Updated
2026-11-02
CVE List No score

LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states "only a few specific / uncommon usages of the API are at risk."

Record
CVE-2019-17543
Updated
2026-11-02
EUVDEUVD-2019-7893 No score

LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states "only a few specific / uncommon usages of the API are at risk."

Record
EUVD-2019-7893
Updated
2026-11-02
GitHub AdvisoriesGHSA-fxrv-74g3-w7qr 8.1

LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to...

LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.)

Record
GHSA-fxrv-74g3-w7qr
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-120, CWE-787
Updated
2026-11-02
OSVALPINE-CVE-2019-17543 8.1

LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states "only a few specific / uncommon usages of the API are at risk."

Record
ALPINE-CVE-2019-17543
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVBELL-CVE-2019-17543 8.1

CVE-2019-17543 does not affect BellSoft software

Record
BELL-CVE-2019-17543
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 12 moreShow less
OSV 8.1

LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states "only a few specific / uncommon usages of the API are at risk."

Record
CVE-2019-17543
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2019-17543 8.1

LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states "only a few specific / uncommon usages of the API are at risk."

Record
DEBIAN-CVE-2019-17543
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:11035 8.1

Red Hat Security Advisory: lz4 security update

Record
RHSA-2025:11035
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2025:11035 8.1

Moderate: lz4 security update

The lz4 packages provide support for LZ4, a very fast, lossless compression algorithm that provides compression speeds of 400 MB/s per core and scales with multicore CPUs. It also features an extremely fast decoder that reaches speeds of multiple GB/s per core and typically reaches RAM speed limits on multicore systems.

Security Fix(es):

  • lz4: heap-based buffer overflow in LZ4_write32 (CVE-2019-17543)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:11035
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2019-17543 8.1

LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states "only a few specific / uncommon usages of the API are at risk."

Record
UBUNTU-CVE-2019-17543
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2025:11035 No score

Moderate: lz4 security update

The lz4 packages provide support for LZ4, a very fast, lossless compression algorithm that provides compression speeds of 400 MB/s per core and scales with multicore CPUs. It also features an extremely fast decoder that reaches speeds of multiple GB/s per core and typically reaches RAM speed limits on multicore systems.

Security Fix(es):

  • lz4: heap-based buffer overflow in LZ4_write32 (CVE-2019-17543)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2025:11035
Updated
2026-11-02
OSVMGASA-2019-0375 No score

Updated lz4 packages fix security vulnerability

Updated lz4 packages fix security vulnerability:

Heap-based buffer overflow in LZ4_write32 (CVE-2019-17543).

Record
MGASA-2019-0375
Updated
2026-11-02
OSVopenSUSE-SU-2019:2398-1 No score

Security update for lz4

This update for lz4 fixes the following issues:

  • CVE-2019-17543: Fixed a heap-based buffer overflow in LZ4_write32 (bsc#1153936).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:2398-1
Updated
2026-11-02
OSVopenSUSE-SU-2019:2399-1 No score

Security update for lz4

This update for lz4 fixes the following issues:

  • CVE-2019-17543: Fixed a heap-based buffer overflow in LZ4_write32 (bsc#1153936).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:2399-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11034-1 No score

liblz4-1-1.9.3-1.5 on GA media

These are all security issues fixed in the liblz4-1-1.9.3-1.5 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11034-1
Updated
2026-11-02
OSVSUSE-SU-2019:2757-1 No score

Security update for lz4

This update for lz4 fixes the following issues:

  • CVE-2019-17543: Fixed a heap-based buffer overflow in LZ4_write32 (bsc#1153936).
Record
SUSE-SU-2019:2757-1
Updated
2026-11-02
OSVSUSE-SU-2021:1613-1 No score

Security update for lz4

This update for lz4 fixes the following issues:

  • CVE-2021-3520: Fixed memory corruption due to an integer overflow bug caused by memmove argument (bsc#1185438).
  • CVE-2019-17543: Fixed heap-based buffer overflow in LZ4_write32 (bsc#1153936).
Record
SUSE-SU-2021:1613-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
lz4
Alpine:v3.10
 before 1.9.1-r1
1.9.1-r1
lz4
Alpine:v3.11
 before 1.9.2-r0
1.9.2-r0
lz4
Alpine:v3.12
 before 1.9.2-r0
1.9.2-r0
lz4
Alpine:v3.13
 before 1.9.2-r0
1.9.2-r0
lz4
Alpine:v3.14
 before 1.9.2-r0
1.9.2-r0
lz4
Alpine:v3.15
 before 1.9.2-r0
1.9.2-r0
lz4
Alpine:v3.16
 before 1.9.2-r0
1.9.2-r0
lz4
Alpine:v3.17
 before 1.9.2-r0
1.9.2-r0
lz4
Alpine:v3.18
 before 1.9.2-r0
1.9.2-r0
lz4
Alpine:v3.19
 before 1.9.2-r0
1.9.2-r0
Show 27 moreShow less
Affected packages
PackageAffectedFixed
lz4
Alpine:v3.20
 before 1.9.2-r0
1.9.2-r0
lz4
Alpine:v3.21
 before 1.9.2-r0
1.9.2-r0
lz4
Alpine:v3.22
 before 1.9.2-r0
1.9.2-r0
lz4
Alpine:v3.23
 before 1.9.2-r0
1.9.2-r0
lz4
Alpine:v3.24
 before 1.9.2-r0
1.9.2-r0
lz4
AlmaLinux:8
 before 1.8.3-5.el8_10
1.8.3-5.el8_10
lz4-devel
AlmaLinux:8
 before 1.8.3-5.el8_10
1.8.3-5.el8_10
lz4-libs
AlmaLinux:8
 before 1.8.3-5.el8_10
1.8.3-5.el8_10
lz4
Debian:12
 before 1.9.2-1
1.9.2-1
lz4
Debian:13
 before 1.9.2-1
1.9.2-1
lz4
Debian:14
 before 1.9.2-1
1.9.2-1
lz4
Mageia:7
 before 1.9.2-1.mga7
1.9.2-1.mga7
lz4
Red Hat:enterprise_linux:8::baseos
 before 0:1.8.3-5.el8_10
0:1.8.3-5.el8_10
lz4-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:1.8.3-5.el8_10
0:1.8.3-5.el8_10
lz4-debugsource
Red Hat:enterprise_linux:8::baseos
 before 0:1.8.3-5.el8_10
0:1.8.3-5.el8_10
lz4-devel
Red Hat:enterprise_linux:8::baseos
 before 0:1.8.3-5.el8_10
0:1.8.3-5.el8_10
lz4-libs
Red Hat:enterprise_linux:8::baseos
 before 0:1.8.3-5.el8_10
0:1.8.3-5.el8_10
lz4-libs-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:1.8.3-5.el8_10
0:1.8.3-5.el8_10
lz4
Rocky Linux:8
 before 0:1.8.3-5.el8_10
0:1.8.3-5.el8_10
lz4
SUSE:Linux Enterprise Module for Basesystem 15
 before 1.8.0-3.5.1
1.8.0-3.5.1
lz4
SUSE:Linux Enterprise Module for Basesystem 15 SP1
 before 1.8.0-3.5.1
1.8.0-3.5.1
lz4
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 1.8.0-3.3.1
1.8.0-3.3.1
lz4
openSUSE:Leap 15.0
 before 1.8.0-lp150.2.3.1
1.8.0-lp150.2.3.1
lz4-test
openSUSE:Leap 15.0
 before 1.8.0-lp150.2.3.1
1.8.0-lp150.2.3.1
lz4
openSUSE:Leap 15.1
 before 1.8.0-lp151.3.3.1
1.8.0-lp151.3.3.1
lz4-test
openSUSE:Leap 15.1
 before 1.8.0-lp151.3.3.1
1.8.0-lp151.3.3.1
lz4
openSUSE:Tumbleweed
 before 1.9.3-1.5
1.9.3-1.5

History

History
WhenChangedSources
2026-11-03affected
2026-11-02createdCVE List, EUVD, GitHub Advisories, NVD, OSV

References

Show 49 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open