Description

A vulnerability was determined in LatencyUtils up to 2.0.3. Affected by this issue is the function LatencyStats.recordDetectedPause of the file src/main/java/org/LatencyUtils/LatencyStats.java of the component PauseDetector. Executing a manipulation can lead to memory corruption. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.3",
  "pubDate": "2026-08-31T00:16:42.150Z",
  "pubdate": "2026-08-31T00:16:42.150Z",
  "executiveSummary": "A critical memory corruption vulnerability has been identified in the LatencyUtils library, affecting versions up to and including 2.0.3.\nThe vulnerability resides within the PauseDetector component, specifically triggered by the LatencyStats.recordDetectedPause function.\nThe flaw allows for memory corruption, which may be leveraged by an attacker to cause system instability or potential arbitrary code execution under specific conditions.\nExploitation of this vulnerability requires local access to the target system, making it an attractive target for privilege escalation or local denial-of-service attacks.\nDespite being reported via formal issue channels, the maintainers have not yet provided a patch or formal response, leaving implementations vulnerable.\nOrganizations utilizing LatencyUtils are advised to evaluate their exposure and monitor for anomalous process behavior as no upstream vendor remediation is currently available.",
  "technicalDetails": "The vulnerability is localized within the src/main/java/org/LatencyUtils/LatencyStats.java file, specifically impacting the logic within the LatencyStats.recordDetectedPause method.\nThe root cause pertains to improper handling of pause duration data or internal state variables during the recording of detected latency pauses, which leads to an out-of-bounds or invalid memory access.\nWhen LatencyStats.recordDetectedPause is invoked, the component processes pause timestamps and durations. If these inputs are crafted in a specific sequence or contain unexpected values, the internal state management mechanisms of the PauseDetector fail to maintain memory safety, leading to corruption of adjacent memory structures.\nAs a Java-based component, memory corruption in this context typically implies potential for heap-based overflows or corruption of internal object references, which can be manipulated to bypass memory protections or overwrite critical data structures within the JVM process space.\nThe attack flow requires an adversary to have local access to the environment where the LatencyUtils-dependent application is executing. By feeding specifically formatted inputs to the PauseDetector, an attacker triggers the faulty logic path in recordDetectedPause.\nBecause the vulnerability is triggered during runtime performance monitoring, an attacker with the ability to influence the monitored system's latency characteristics or feed data into the statistics gathering mechanism can induce the corruptive state.\nPost-exploitation impact includes the potential for an application crash (Denial of Service), or in more sophisticated scenarios, the potential to corrupt object references to facilitate unauthorized memory read/write primitives.\nThis vulnerability is classified as locally exploitable, meaning the threat actor must be able to execute code on the host machine or interact with a local service that interfaces with the vulnerable library. The lack of upstream vendor engagement exacerbates the risk, as there is currently no established secure baseline or patch version for affected users."
}