XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.
CVSS Details
- CVSS 4.0 Base Score: 1.7 (LOW)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade xz | Apr 29, 2026 | Apr 2, 2026 |
| Debian | — | Upgrade xz-utils | Jul 14, 2026 | Jul 14, 2026 |
| Redhat_linux | — | Upgrade xz-debuginfoUpgrade xz-libsUpgrade xzUpgrade xz-libs-debuginfoUpgrade xz-develUpgrade xz-debugsourceUpgrade xz-lzma-compat-debuginfoUpgrade xz-lzma-compatNo solution exists | Jul 17, 2026 | Apr 2, 2026 |
| Rocky_linux | — | Upgrade xz-lzma-compatUpgrade xzUpgrade xz-libs-debuginfoUpgrade xz-develUpgrade xz-debuginfoUpgrade xz-libsUpgrade xz-debugsourceUpgrade xz-lzma-compat-debuginfo | Sep 15, 2026 | Sep 9, 2026 |
| Ubuntu | — | Upgrade liblzma5Upgrade xz-utilsUpgrade xzdecUpgrade xzdec (Ubuntu Pro)Upgrade xz-utils (Ubuntu Pro)Upgrade liblzma5 (Ubuntu Pro) | Jun 2, 2026 | Jun 2, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Apr 2, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub