What’s Vulnerable › Vulnerabilities

CVE-2026-34743: XZ Utils: Buffer overflow in lzma_index_append()

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-02 · updated 2026-07-24
• Weakness: CWE-122

Description

XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.

Affected products

• tukaani-project xz: before 5.8.3 — fixed in 5.8.3

How to fix

Upgrade to a fixed version: tukaani-project xz 5.8.3. Check the vendor advisory for mitigations.

References

• https://github.com/tukaani-project/xz/commit/c8c22869e780ff57c96b46939c3d79ff99395f87
• https://github.com/tukaani-project/xz/releases/tag/v5.8.3
• https://github.com/tukaani-project/xz/security/advisories/GHSA-x872-m794-cxhv
• http://www.openwall.com/lists/oss-security/2026/03/31/13
• https://lists.debian.org/debian-lts-announce/2026/07/msg00034.html

Get alerted when CVE-2026-34743 or the next vulnerability affects your stack