CVE-2025-31115

HIGH

XZ has a heap-use-after-free bug in threaded .xz decoder

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2025-31115 has a selected CVSS score of 8.7 (high); EIP currently links 1 repository PoC.

Description

XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects include heap use after free and writing to an address based on the null pointer plus an offset. Applications and libraries that use the lzma_stream_decoder_mt function are affected. The bug has been fixed in XZ Utils 5.8.1, and the fix has been committed to the v5.4, v5.6, v5.8, and master branches in the xz Git repository. No new release packages will be made from the old stable branches, but a standalone patch is available that applies to all affected releases.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 3, 2025 · Source: CVE List

Affected products and versions

4
ProductSourceVersion range

SIMATIC S7-1500 CPU 1518-4 PN/DP MFP

Browse Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP

Default status: unknown

CVE ListV3.1.5 to < *affected

SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP

Browse Siemens / SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP

Default status: unknown

CVE ListV3.1.5 to < *affected

SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

Browse Siemens / SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

Default status: unknown

CVE ListV3.1.5 to < *affected

xz

Browse tukaani-project / xz
CVE List>= 5.3.3alpha, < 5.8.1affected

Proofs of concept

1

Repository PoCs

GitHubgreydoubt/xzRepository PoCby greydoubt1Writeup146 files

366.6 KiB · linked to 5 vulnerabilities

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a README file listing security issues for the xz project, accompanied by a Windows build script. It provides a textual summary of CVEs but contains no exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The reviewed text files (README.md and windows/build-with-cmake.bat) contain no backdoor, deceptive payload, or concealed executable behavior. README.md lists known CVEs; build-with-cmake.bat is a straightforward build script. No findings of concern.

ClassificationWriteup
Model confidence95%
AuthenticationUnknown
LanguagesMarkdownBatchfile
Target softwarexz
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The supplied text files are a README listing CVEs and a build script. Neither file contains code that exercises, exploits, or scans for a vulnerability. The content is a technical summary of known issues, which matches the definition of a writeup.

README.md:1-2windows/build-with-cmake.bat:1-35

Observed behavior

  • The README lists five CVE identifiers as security issues.README.md:1-2
  • The build script configures and compiles xz using CMake and MinGW-w64.windows/build-with-cmake.bat:29-30
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Cve Reference
CVE-2024-3094README.md lists CVE-2024-3094 (liblzma backdoor) as a known security issue, indicating awareness of past supply-chain compromise.README.md:2
Review boundaries

What the analysis did not establish

  • Only 2 of 146 files were provided as text; 95 binary files were flagged but not analyzed, and 49 text files were omitted. The classification is based solely on the supplied README and build script.
  • 95 binary files were not analyzed; their content could contain backdoor or malicious payloads not visible in the reviewed text.
  • Only 2 of 51 text files were included; the remaining 49 text files were omitted and may contain evidence not reviewed.
  • The artifact is associated with CVE-2024-3094, a known backdoor in xz, but the reviewed files do not themselves exhibit backdoor behavior.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

7