CVE-2026-34743
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
XZ Utils prior to version 5.8.3 has a buffer overflow vulnerability when decoding an Index with no Records. The lzma_index_decoder() function leaves the index in a state where a subsequent lzma_index_append() allocates insufficient memory, causing a buffer overflow.
Risk Assessment
An attacker can remotely cause application crashes or potentially execute arbitrary code, threatening system integrity and availability.
Recommendation
Immediately update XZ Utils to version 5.8.3 or later.
Original NVD description (English source)
XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.