CVE-2026-106451: yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user

When no system-installed liblz4-java is found, net.jpountz.util.Native.load() extracts the bundled native library to java.io.tmpdir and loads it with System.load. The path of the extracted library can be predicted before it is created, and the library file is opened without exclusive creation. Another local user who can write to the same temporary directory can therefore create the file first and control the code that is loaded.