CVE-2026-106451: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition in yawkat lz4-java

yawkat lz4-java versions from 1.7.0 up to but not including 1.11.4 contain a TOCTOU race condition in the native library loading process. The method net.jpountz.util.Native.load() creates a temporary .lck file exclusively but then derives the native library path by removing the suffix. The subsequent FileOutputStream opens this predictable path without exclusive creation, enabling a local user with access to the shared temporary directory to create or replace the native library file before System.load() uses it. Exploitation depends on shared-directory permissions, host protections, and winning the race condition. Successful exploitation can lead to arbitrary native code execution in the victim process. Systems using a system library, a private java.io.tmpdir, or Java-only implementations are not affected. The vulnerability is resolved in version 1.11.4.

An attacker with local access to the shared temporary directory can exploit this race condition to execute arbitrary native code within the context of the victim process using the vulnerable yawkat lz4-java library. This can lead to privilege escalation or other malicious actions depending on the victim's privileges. Hardened systems may prevent exploitation by causing library loading to fail and falling back to Java implementations, reducing impact.

Upgrade to yawkat lz4-java version 1.11.4 or later, where this vulnerability is fixed. Alternatively, use configurations that avoid the vulnerable code path, such as using a system library, a private java.io.tmpdir, or Java-only implementations. No other specific mitigations are indicated.