CVE-2014-4607: Integer overflow in the LZO algorithm variant in Oberhumer liblzo2 and lzo-2 before 2.07 on 32-bit platform...

Security readout for executives and security teams

This is a memory-safety issue in older LZO compression code on 32-bit systems. A crafted compressed input could trigger an integer overflow in a Literal Run and may allow remote code execution in software that decompresses untrusted LZO data. Business urgency depends on whether affected LZO versions are present and exposed to attacker-controlled compressed content. Exposure is most likely in 32-bit software or appliances that include liblzo2 or lzo-2 before 2.07 and process untrusted LZO-compressed data. The source bundle does not identify specific downstream products, packages, or deployments. Prioritize assessment where legacy 32-bit systems or products handle external compressed input. The potential impact is serious because remote code execution is described, but urgency should be tied to confirmed dependency presence and exposure. Mitigation focus: Inventory systems and software using liblzo2 or lzo-2.; Upgrade affected LZO components to version 2.07 or later.; Prioritize 32-bit systems processing untrusted compressed data..

Prepared

Jun 6, 2026, 02:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.