yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load() uses File.createTempFile to create an exclusive temporary .lck file but derives the native-library path by removing the suffix, then FileOutputStream opens that predictable path without exclusive creation, allowing another local user with access to the same shared temporary directory to create or replace the library file before System.load() uses it. Successful exploitation depends on shared-directory permissions, host protections, and winning the race, and can execute native code as the victim; hardened systems may instead cause library loading to fail and fall back to Java implementations. Configurations using a system library, a private java.io.tmpdir, or Java-only implementations are not affected. This issue is fixed in version 1.11.4.

Affected: Maven: at.yawk.lz4:lz4-java, Maven: org.lz4:lz4-java

### Summary

When no system-installed `liblz4-java` is found, `net.jpountz.util.Native.load()` extracts the bundled native library to `java.io.tmpdir` and loads it with `System.load`. The path of the extracted library can be predicted before it is created, and the library file is opened without exclusive creation. Another local user who can write to the same temporary directory can therefore create the file first and control the code that is loaded.

### Details

```java tempLibLock = File.createTempFile("liblz4-java-", "." + os().libExtension + ".lck"); tempLib = new File(tempLibLock.getAbsolutePath().replaceFirst(".lck$", "")); // copy to tempLib try (FileOutputStream out = new FileOutputStream(tempLib)) { ... } ... System.load(tempLib.getAbsolutePath()); ```

Only the `.lck` file is created safely, with a random name and exclusive creation. The library path is the `.lck` name without the `.lck` suffix, and nothing reserves it. `new FileOutputStream(tempLib)` opens it with `O_CREAT|O_TRUNC` and follows symlinks.

In a shared, world-writable temporary directory, another user can watch for the `.lck` file and create the corresponding library file before it is opened. If they win that race, they own the file. The victim then writes into the attacker-owned file, and the attacker can overwrite it again before `System.load`.

Whether this can be exploited depends on the host:

- With `fs.protected_regular = 0`, the attacker can pre-create a world-writable file, and their code is…

Affected: Ubuntu:20.04:LTS: lz4-java, Ubuntu:22.04:LTS: lz4-java, Ubuntu:24.04:LTS: lz4-java, Ubuntu:26.04:LTS: lz4-java

(yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1. ...)