A range‑check flaw in org.HdrHistogram.DoubleHistogram.record compares values incorrectly when recording histogram data. This control‑flow error (CWE‑697) can allow an adversary with local access to influence the metrics produced by the library, potentially distorting monitoring, alerting, or other processes that rely on accurate histogram data.

Any Java application that embeds the HdrHistogram library version 2.2.2 or earlier. The flaw is in the library itself and is not tied to any specific vendor product, so any usage of the library in a local code base is at risk.

The CVSS score of 4.8 classifies the issue as medium severity. The EPSS score of less than 1 % indicates a low likelihood of exploitation. The vulnerability is disputed and its presence remains uncertain, but if it exists it requires local code execution or the ability to supply input to recordValue. The likely attack vector is local code execution; an attacker with such privileges could replace or corrupt histogram values, thereby misleading dependent systems and potentially causing false alarms or missed events. Because the flaw does not cross traditional security boundaries, exploitation may be limited to trusted code paths unless additional vulnerabilities are combined.