Skip to content
OpenAdvisories
High USN-7414-1 1 CVE

xz-utils vulnerability

Published Apr 3, 2025 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

Harri K. Koskinen discovered that XZ Utils incorrectly handled the threaded
xz decoder. If a user or automated system were tricked into processing an
xz file, a remote attacker could use this issue to cause XZ Utils to crash,
resulting in a denial of service, or possibly execute arbitrary code.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 24.04 LTS 24.04:LTS xz-utils 5.6.1+really5.4.5-1ubuntu0.2

Vulnerabilities 1

  • High 8.7
    CVE-2025-31115

    XZ has a heap-use-after-free bug in threaded .xz decoder

    XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects include heap use after fre…

    tukaani-project xz xz-utils xz Debian Ubuntu Azure Linux Alpine Hackage

References

  • report
    https://ubuntu.com/security/CVE-2025-31115