XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.
CVSS Details
- CVSS 4.0 Base Score: 1.7 (LOW)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade xz | Apr 29, 2026 | Apr 2, 2026 |
| Debian | — | Upgrade xz-utils | Jul 14, 2026 | Jul 14, 2026 |
| Redhat_linux | — | Upgrade xz-debuginfoUpgrade xz-libsUpgrade xz-develUpgrade xz-lzma-compat-debuginfoNo solution existsUpgrade xz-debugsourceUpgrade xzUpgrade xz-libs-debuginfoUpgrade xz-lzma-compat | Jul 17, 2026 | Apr 2, 2026 |
| Rocky_linux | — | Upgrade xz-lzma-compat-debuginfoUpgrade xz-debuginfoUpgrade xz-libsUpgrade xz-debugsourceUpgrade xzUpgrade xz-libs-debuginfoUpgrade xz-lzma-compatUpgrade xz-devel | Sep 15, 2026 | Sep 9, 2026 |
| Ubuntu | — | Upgrade xzdec (Ubuntu Pro)Upgrade liblzma5 (Ubuntu Pro)Upgrade xzdecUpgrade xz-utils (Ubuntu Pro)Upgrade xz-utilsUpgrade liblzma5 | Jun 2, 2026 | Jun 2, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Apr 2, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub