XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.
CVSS Details
- CVSS 4.0 Base Score: 1.7 (LOW)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade xz | Apr 29, 2026 | Apr 2, 2026 |
| Debian | — | Upgrade xz-utils | Jul 14, 2026 | Jul 14, 2026 |
| Redhat_linux | — | Upgrade xz-libs-debuginfoUpgrade xzUpgrade xz-lzma-compatUpgrade xz-debugsourceUpgrade xz-develNo solution existsUpgrade xz-lzma-compat-debuginfoUpgrade xz-debuginfoUpgrade xz-libs | Jul 17, 2026 | Apr 2, 2026 |
| Rocky_linux | — | Upgrade xz-debuginfoUpgrade xz-lzma-compat-debuginfoUpgrade xz-debugsourceUpgrade xz-libsUpgrade xzUpgrade xz-libs-debuginfoUpgrade xz-develUpgrade xz-lzma-compat | Sep 15, 2026 | Sep 9, 2026 |
| Ubuntu | — | Upgrade xz-utilsUpgrade liblzma5Upgrade xzdecUpgrade xzdec (Ubuntu Pro)Upgrade xz-utils (Ubuntu Pro)Upgrade liblzma5 (Ubuntu Pro) | Jun 2, 2026 | Jun 2, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Apr 2, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub