CVE-2026-32829 affects lz4_flex, a pure Rust LZ4 compression/decompression library. In affected versions (<=0.11.5 and =0.12.0), the library fails to properly validate offset values during LZ4 match copy operations in block-based API functions (such as decompress_into and decompress_into_with_dict) when safe-decode is disabled. This allows out-of-bounds reads from the output buffer, potentially leaking sensitive information from uninitialized memory or previous decompression outputs. Frame APIs are not affected. The vulnerability is addressed in versions 0.11.6 and 0.12.1. Red Hat's advisory notes minimal risk in their products due to the component's limited use case, requiring local access and privileges for exploitation.

The vulnerability can lead to exposure of sensitive data and secrets through crafted or malformed LZ4 input by causing out-of-bounds reads from the output buffer during decompression. However, in Red Hat products such as RHEL 9 and 10, the risk is minimal because the vulnerable component decompresses only its own internal database, not external or untrusted data. Exploitation requires local access and sufficient privileges to modify internal cache files. There are no known exploits in the wild.

A fix is available and has been released in versions 0.11.6 and 0.12.1 of lz4_flex. Users should upgrade to these or later versions to remediate the vulnerability. For Red Hat OpenShift Logging 6.5, update to version 6.5.1 as per Red Hat's advisory. Since the vulnerability requires local access and privileges for exploitation in Red Hat products, no additional mitigations are necessary beyond applying the official updates.