Vulnerability · Published Apr 2, 2026 · Assigned by GitHub_M
CVE-2026-34743XZ Utils: Buffer overflow in lzma_index_append()
Low 1.7
In plain English
A low-severity heap buffer overflow in xz from tukaani-project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | xz | 1:5.6.2-4.el10_2.1 | ALSA-2026:64787 |
| AlmaLinux:9 | xz | 5.2.5-8.el9_8.1 | ALSA-2026:89749 |
| AlmaLinux:10 | xz-devel | 1:5.6.2-4.el10_2.1 | ALSA-2026:64787 |
| AlmaLinux:9 | xz-devel | 5.2.5-8.el9_8.1 | ALSA-2026:89749 |
| AlmaLinux:10 | xz-libs | 1:5.6.2-4.el10_2.1 | ALSA-2026:64787 |
| AlmaLinux:9 | xz-libs | 5.2.5-8.el9_8.1 | ALSA-2026:89749 |
| AlmaLinux:10 | xz-lzma-compat | 1:5.6.2-4.el10_2.1 | ALSA-2026:64787 |
| AlmaLinux:9 | xz-lzma-compat | 5.2.5-8.el9_8.1 | ALSA-2026:89749 |
| Alpine:v3.20 | xz | 5.8.3-r0 | ALPINE-CVE-2026-34743 |
| Alpine:v3.21 | xz | 5.8.3-r0 | ALPINE-CVE-2026-34743 |
| Alpine:v3.22 | xz | 5.8.3-r0 | ALPINE-CVE-2026-34743 |
| Alpine:v3.23 | xz | 5.8.3-r0 | ALPINE-CVE-2026-34743 |
| Alpine:v3.24 | xz | 5.8.3-r0 | ALPINE-CVE-2026-34743 |
| Debian:12 | xz-utils | 5.4.1-1+deb12u1 | DEBIAN-CVE-2026-34743 |
| Debian:13 | xz-utils | 5.8.1-1+deb13u1 | DEBIAN-CVE-2026-34743 |
| Debian:14 | xz-utils | 5.8.3-1 | DEBIAN-CVE-2026-34743 |
| Rocky Linux:10 | xz | 1:5.6.2-4.el10_2.1 | RLSA-2026:64787 |
| Rocky Linux:9 | xz | 0:5.2.5-8.el9_8.1 | RLSA-2026:89749 |
| Ubuntu:22.04:LTS | xz-utils | 5.2.5-2ubuntu1.1 | USN-8362-1 |
| Ubuntu:22.04:LTS | xz-utils | 5.2.5-2ubuntu1.1 | UBUNTU-CVE-2026-34743 |
| Ubuntu:24.04:LTS | xz-utils | 5.6.1+really5.4.5-1ubuntu0.3 | USN-8362-1 |
| Ubuntu:24.04:LTS | xz-utils | 5.6.1+really5.4.5-1ubuntu0.3 | UBUNTU-CVE-2026-34743 |
| Ubuntu:25.10 | xz-utils | 5.8.1-1ubuntu0.1 | UBUNTU-CVE-2026-34743 |
| Ubuntu:25.10 | xz-utils | 5.8.1-1ubuntu0.1 | USN-8362-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| tukaani-project | xz | < 5.8.3 |
Weakness: CWE-122 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
References
- https://github.com/tukaani-project/xz/security/advisories/GHSA-x872-m794-cxhv x_refsource_CONFIRM
- https://github.com/tukaani-project/xz/commit/c8c22869e780ff57c96b46939c3d79ff99395f87 x_refsource_MISC
- https://github.com/tukaani-project/xz/releases/tag/v5.8.3 x_refsource_MISC
- http://www.openwall.com/lists/oss-security/2026/03/31/13
- https://lists.debian.org/debian-lts-announce/2026/07/msg00034.html