Description
XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.
References (4)
Core 4
Core References
X_Refsource_Confirm x_refsource_confirm
https://github.com/tukaani-project/xz/security/advisories/GHSA-x872-m794-cxhv
X_Refsource_Misc x_refsource_misc
https://github.com/tukaani-project/xz/commit/c8c22869e780ff57c96b46939c3d79ff99395f87
X_Refsource_Misc x_refsource_misc
https://github.com/tukaani-project/xz/releases/tag/v5.8.3
Scores
CVSS v3
5.3
EPSS
0.0035
EPSS Percentile
26.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-122
Status
published
Products (2)
tukaani/xz
< 5.8.3
tukaani-project/xz
< 5.8.3
Published
Apr 02, 2026
Tracked Since
Apr 03, 2026