Skip to content
OpenAdvisories
Low USN-8362-1 1 CVE

xz-utils vulnerability

Published Jun 2, 2026 · Updated Jun 2, 2026

Ecosystem: Ubuntu

Summary

It was discovered that XZ Utils did not properly manage memory when
attempting to append data to a decoded index that contained no records.
An attacker could possibly use this issue to cause XZ Utils to crash,
resulting in a denial of service, or execute arbitrary code.

Fixed packages 7

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS xz-utils 5.2.5-2ubuntu1.1
Ubuntu · 24.04 LTS 24.04:LTS xz-utils 5.6.1+really5.4.5-1ubuntu0.3
Ubuntu · 25.10 xz-utils 5.8.1-1ubuntu0.1
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS xz-utils 5.1.1alpha+20120614-2ubuntu2.14.04.1+esm2
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS xz-utils 5.1.1alpha+20120614-2ubuntu2.16.04.1+esm2
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS xz-utils 5.2.2-1.3ubuntu0.1+esm1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS xz-utils 5.2.4-1ubuntu1.1+esm1

Vulnerabilities 1

  • Low 1.7
    CVE-2026-34743

    XZ Utils: Buffer overflow in lzma_index_append()

    XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent l…

    tukaani-project xz rust xz Debian Ubuntu Azure Linux Alpine

References

  • report
    https://ubuntu.com/security/CVE-2026-34743