CVE-2019-17543: LZ4 Project LZ4

High severity, CVSS 8.1. EPSS: 9.1% chance of exploitation in the next 30 days.

LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states "only a few specific / uncommon usages of the API are at risk."

Affected products

• LZ4 Project LZ4: before 1.9.2 (fixed in 1.9.2)

Published 2019-10-14. Last modified 2026-10-08.