CVE-2026-34743

Name
CVE-2026-34743
Description
XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
security-advisories@github.com https://github.com/tukaani-project/xz/commit/c8c22869e780ff57c96b46939c3d79ff99395f87
security-advisories@github.com https://github.com/tukaani-project/xz/releases/tag/v5.8.3
security-advisories@github.com https://github.com/tukaani-project/xz/security/advisories/GHSA-x872-m794-cxhv
af854a3a-2127-422b-91ae-364da2661108 http://www.openwall.com/lists/oss-security/2026/03/31/13
af854a3a-2127-422b-91ae-364da2661108 https://lists.debian.org/debian-lts-announce/2026/07/msg00034.html

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:tukaani:xz:*:*:*:*:*:*:*:* xz >= None < 5.8.3

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
xz edge-main 5.8.3-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
xz edge-main 5.8.2-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
xz edge-main 5.8.1-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
xz edge-main 5.8.0-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
xz edge-main 5.6.4-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
xz edge-main 5.6.3-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
xz edge-main 5.6.1-r3 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
xz edge-main 5.6.1-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
xz edge-main 5.6.1-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
xz edge-main 5.2.5-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
xz 3.24-main 5.8.3-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
xz 3.23-main 5.8.3-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
xz 3.23-main 5.8.2-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
xz 3.23-main 5.8.1-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
xz 3.22-main 5.8.3-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
xz 3.22-main 5.8.1-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
xz 3.22-main 5.6.1-r2 None possibly vulnerable
xz 3.22-main 5.2.5-r1 None possibly vulnerable
xz 3.21-main 5.8.3-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
xz 3.21-main 5.6.3-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
xz 3.21-main 5.6.3-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
xz 3.21-main 5.6.1-r2 None possibly vulnerable
xz 3.21-main 5.2.5-r1 None possibly vulnerable
xz 3.20-main 5.8.3-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
xz 3.20-main 5.6.2-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
xz 3.20-main 5.6.2-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
xz 3.20-main 5.6.1-r3 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
xz 3.20-main 5.6.1-r2 None possibly vulnerable
xz 3.20-main 5.2.5-r1 None possibly vulnerable
xz 3.19-main 5.4.5-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
xz 3.19-main 5.4.5-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
xz 3.19-main 5.2.5-r1 None possibly vulnerable