CVE-2025-58058 Details

A vulnerability in the Ulikunitz XZ package, prior to version 0.5.14, allows for the introduction of data before an LZMA-encoded byte stream without proper detection while reading the header. This oversight can lead to excessive memory usage, as the implementation allocates the full decoding buffer immediately after the header is read. The LZMA header lacks a magic number or checksum to identify such issues, following the official specification. Although the problem is recognized later in the stream, the memory allocation has already occurred, potentially causing significant memory leaks, especially when processing multiple LZMA archives with corrupted headers. This vulnerability affects software that utilizes 'lzma.NewReader' or 'lzma.ReaderConfig.NewReader'.

Users can update to Ulikunitz XZ version 0.5.14 or later, which includes mitigations such as limiting the dictionary size to prevent excessive memory allocations. Instructions for updating can be found in the Ulikunitz XZ repository on GitHub.