CVE-2026-14686

LOW

HdrHistogram Range Check DoubleHistogram.java org.HdrHistogram.DoubleHistogram.recordValue comparison

Title source: cna
STIX 2.1

Description

A vulnerability was found in HdrHistogram up to 2.2.2. This issue affects the function org.HdrHistogram.DoubleHistogram.recordValue of the file src/main/java/org/HdrHistogram/DoubleHistogram.java of the component Range Check. Performing a manipulation results in incorrect comparison. The attack is only possible with local access. The exploit has been made public and could be used. The presence of this vulnerability remains uncertain at this time. This issue is disputed due to the potential lack of crossing of security boundaries and the pre-requisites for a successful attack.

References (6)

Core 6
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-376282 | HdrHistogram Range Check DoubleHistogram.java org.HdrHistogram.DoubleHistogram.recordValue comparison
https://vuldb.com/vuln/376282
Signature, Permissions Required signature permissions-required
VDB-376282 | CTI Indicators (IOB, IOC, IOA)
https://vuldb.com/vuln/376282/cti
Third Party Advisory third-party-advisory
CVE-2026-14686 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-14686
Third Party Advisory third-party-advisory
Submit #846762 | HdrHistogram (Open Source) HdrHistogram 2.2.2 and earlier Improper Input Validation
https://vuldb.com/submit/846762

Scores

CVSS v3 3.3
EPSS 0.0024
EPSS Percentile 15.3%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-697
Status published
Products (3)
None/HdrHistogram 2.2.0
None/HdrHistogram 2.2.1
None/HdrHistogram 2.2.2
Published Jul 05, 2026
Tracked Since Jul 05, 2026