lZ4_flex, a pure Rust LZ4 compression library, contains a flaw that permits the extraction of secrets from uninitialized memory or from prior decompression operations. The bug arises when invalid LZ4 data causes the library to fail in validating offset values during match copy operations, leading to out-of-bounds reads from the output buffer. The vulnerability is captured by CWE‑201 and CWE‑823 and results in the potential leakage of sensitive data through crafted or malformed input streams.

The affected product is the lz4_flex library from PSeitz, specifically versions 0.11.5 and earlier, as well as version 0.12.0. The block‑based decompression APIs, including decompress_into and decompress_into_with_dict, are vulnerable when the safe-decode feature is disabled. Frame‑based APIs remain unaffected.

The CVSS score of 8.2 indicates a high severity. EPSS is below 1 %, reflecting a low likelihood that the vulnerability is actively exploited in the wild, and it is not listed in CISA’s KEV catalog. Attackers would need to deliver malicious LZ4 payloads that target the vulnerable block‑based decompression functions. The impact is confined to environments that process untrusted LZ4 data with this library; as the breach is information disclosure, a successful exploit would expose data or secrets contained in memory.