CVE-2026-82596 LatencyUtils PauseDetector LatencyStats.java LatencyStats.recordDetectedPause memory corruption
Local attackers can trigger memory corruption in LatencyUtils via the PauseDetector component, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-82596?
CVE-2026-82596 is a medium-severity memory corruption vulnerability in LatencyUtils, published on 31 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability was determined in LatencyUtils up to 2.0.3. Affected by this issue is the function LatencyStats.recordDetectedPause of the file src/main/java/org/LatencyUtils/LatencyStats.java of the component PauseDetector. Executing a manipulation can lead to memory corruption. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Weakness: CWE-119
Which versions are affected by CVE-2026-82596?
How do I fix CVE-2026-82596?
No fix has been published for CVE-2026-82596 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-82596 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-82596 exists.
Sources
Also known as GHSA-m6mq-9wjq-4748.