High SA26P009 1 CVE

XZ Utils vulnerability impacting B&R Products

Published Jun 10, 2026 · Updated Jun 10, 2026

Vendor: B&R Industrial Automation Product: C50 Product: C80 Product: FT50 Product: MT50 Product: PPC3100 Product: T30 Product: T50 Product: T80

Summary

An update is available that resolves vulnerability in the product versions listed as affected in the advisory.

An attacker who successfully exploited this vulnerability could cause the product to stop or corrupt memory data.

Vulnerabilities 1

High 8.7

CVE-2025-31115

XZ has a heap-use-after-free bug in threaded .xz decoder

XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects include heap use after fre…

tukaani-project xz xz-utils xz Debian Ubuntu Alpine Hackage

Apr 3, 2025

Revision history

2026-06-10 #1
Initial version.

References

B&R CYBERSECURITY ADVISORY - PDF Version
https://br-cws-assets.de-fra-1.linodeobjects.com/SA26P009-b2b4dd6d.pdf
Defense in Depth for B&R products
https://www.br-automation.com/fileadmin/Cyber_Security_-_Defense_in_Depth_for_BR_Products-bdd37e82.pdf