CVE-2026-34743 Details
Description
XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.
A buffer overflow vulnerability has been identified in XZ Utils versions prior to 5.8.3. The issue arises in the lzma_index_append() function when it is used to append Records to an lzma_index that has been decoded from an Index containing no Records. In this scenario, the lzma_index is left with an incorrect internal state, leading to insufficient memory allocation and the potential for a buffer overflow. This vulnerability exists in all stable releases of XZ Utils since version 5.0.0.
Users can upgrade to XZ Utils version 5.8.3, which addresses this vulnerability. This version is available on the XZ Utils website. For users of XZ Utils versions 5.2, 5.4, and 5.6, the fix is also available in the Git repository branches v5.6, v5.4, and v5.2.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://lists.debian.org/debian-lts-announce/2026/07/msg00034.html | CVE | |
| http://www.openwall.com/lists/oss-security/2026/03/31/13 | CVE | Mailing ListPatchThird Party Advisory |
| https://github.com/tukaani-project/xz/commit/c8c22869e780ff57c96b46939c3d79ff99395f87 | [email protected] | Patch |
| https://github.com/tukaani-project/xz/releases/tag/v5.8.3 | [email protected] | ProductRelease Notes |
| https://github.com/tukaani-project/xz/security/advisories/GHSA-x872-m794-cxhv | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-122 | Heap-based Buffer Overflow | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| tukaani xz | < 5.8.3 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jul 21, 2026 | CVE Modified | CVE |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 15, 2026 | Initial Analysis | [email protected] |
| Apr 2, 2026 | CVE Modified | CVE |
| Apr 2, 2026 | New CVE Received | [email protected] |