Description
XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
tukaani-project xz
< 5.8.3affected
References
- https://github.com/tukaani-project/xz/security/advisories/GHSA-x872-m794-cxhv ↗
- https://github.com/tukaani-project/xz/commit/c8c22869e780ff57c96b46939c3d79ff99395f87 ↗
- https://github.com/tukaani-project/xz/releases/tag/v5.8.3 ↗
- http://www.openwall.com/lists/oss-security/2026/03/31/13 ↗
- https://lists.debian.org/debian-lts-announce/2026/07/msg00034.html ↗