Description
XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects include heap use after free and writing to an address based on the null pointer plus an offset. Applications and libraries that use the lzma_stream_decoder_mt function are affected. The bug has been fixed in XZ Utils 5.8.1, and the fix has been committed to the v5.4, v5.6, v5.8, and master branches in the xz Git repository. No new release packages will be made from the old stable branches, but a standalone patch is available that applies to all affected releases.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| tukaani-project | xz | >= 5.3.3alpha, < 5.8.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | xz-utils | 5.8.1-1 | — |
| Debian 13 | xz-utils | 5.8.1-1 | — |
| Debian 12 | xz-utils | 5.4.1-1 | DSA-5895-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | xz-utils | 5.6.1+really5.4.5-1ubuntu0.2 | USN-7414-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | xz +3 | 1:5.6.2-4.el10_0 | RHSA-2025:7524 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | xz +3 | 1:5.6.2-4.el10_0 | ALSA-2025:7524 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | xz | 1:5.6.2-4.el10_0 | RLSA-2025:7524 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | xz | 5.4.1-150600.3.3.1 | SUSE-SU-2025:1137-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 6.1 | xz | 5.4.3-slfo.1.1_2.1 | SUSE-SU-2025:20590-1 |
| SLE Micro 6.0 | xz | 5.4.3-5.1 | SUSE-SU-2025:20553-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | xz | 5.8.1-1.1 | openSUSE-SU-2025:14984-1 |
| openSUSE Leap 15.6 | xz | 5.4.1-150600.3.3.1 | SUSE-SU-2025:1137-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | xz | 5.8.1-r0 | — |
| Alpine v3.23 | xz | 5.8.1-r0 | — |
| Alpine v3.22 | xz | 5.8.1-r0 | — |
| Alpine v3.21 | xz | 5.6.3-r1 | — |
| Alpine v3.20 | xz | 5.6.2-r1 | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | xz | 5.4.5-r1 | — |
| Alpine v3.18 | xz | 5.4.3-r1 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | xz | 5.4.4-2 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | xz +3 | 1:5.6.2-4.el10_0 | ELSA-2025-7524 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Hackage | xz-clib | >= 5.6.3, < 5.8.1 | 5.8.1 | HSEC-2025-0003 |
Advisories 17
- ALSA-2025:7524 Important: xz security update AlmaLinux Security Advisories · Oct 29, 2026
- SSA-082556 SSA-082556: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.5 Siemens ProductCERT · Oct 13, 2026
- WID-SEC-2025-1439 Dell Secure Connect Gateway: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Oct 11, 2026
- RHSA-2025:7524 Red Hat Security Advisory: xz security update Red Hat Security Advisories (RHSA) · Sep 1, 2026
- ICSA-26-181-05 XZ Utils vulnerability impacting B&R Products CISA ICS & IT advisories · Jun 30, 2026
- SA26P009 XZ Utils vulnerability impacting B&R Products ABB PSIRT · Jun 10, 2026
- ICSA-25-162-05 Siemens SIMATIC S7-1500 CPU family CISA ICS & IT advisories · May 14, 2026
- USN-7414-1 xz-utils vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026
- SUSE-SU-2025:20553-1 Security update for xz SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20590-1 Security update for xz SUSE / openSUSE Security Updates · Mar 23, 2026
- DSA-5895-1 xz-utils - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2025:1137-1 Security update for xz SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:14984-1 liblzma5-32bit-5.8.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- RLSA-2025:7524 Important: xz security update Rocky Linux Security Advisories · Oct 8, 2025
- WID-SEC-2025-0704 xz: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Aug 31, 2025
- ELSA-2025-7524 Important: xz security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jun 27, 2025
- NCSC-2025-0187 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Jun 10, 2025