CVE-2026-32829 affects lz4_flex, a pure Rust LZ4 compression/decompression library. In versions <0.11.6 and =0.12.0, the library fails to properly validate offset values during LZ4 match copy operations in block-based API functions (e.g., decompress_into, decompress_into_with_dict) when safe-decode is disabled. This flaw allows out-of-bounds reads from the output buffer, potentially leaking sensitive information from uninitialized memory or previous decompression outputs. Frame APIs are not affected. The vulnerability has been addressed in versions 0.11.6 and 0.12.1. Red Hat's advisory highlights that in their RHEL 9 and 10 products, the risk is minimal because the affected component operates in a closed loop decompressing only internal data, requiring local access and privileges for exploitation.

The vulnerability allows an attacker to cause the decompression function to read out-of-bounds memory, potentially exposing sensitive information or secrets from uninitialized memory or prior decompression operations. This confidentiality breach could occur when processing crafted or malformed LZ4 input data. There is no indication of integrity or availability impact. Red Hat states that exploitation risk in their products is minimal due to the limited attack surface and required local access with privileges.

A fix is available and has been released in lz4_flex versions 0.11.6 and 0.12.1. Users should upgrade to these or later versions to remediate the vulnerability. Red Hat advises that in their RHEL 9 and 10 products, the risk is minimal and exploitation requires local access and privileges, so no additional mitigation is necessary beyond applying the update. Users should ensure that block-based API functions do not process untrusted data with safe-decode disabled.