Skip to content
Fencer Vulns
medium 5.3

CVE-2026-34743 json

XZ Utils: Buffer overflow in lzma_index_append()

published 2026-04-02 7 mo ago modified 2026-07-25 3 mo ago also EUVD-2026-18505 , JLSEC-2026-462

cvss
5.3
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 45%
public exploits
0
none known

Summary

XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.

Patch / fix

  • julia XZ_jll 5.8.3+0
  • tukaani xz 5.8.3
  • xz-utils Debian 12 5.4.1-1+deb12u1
  • xz-utils Debian 13 5.8.1-1+deb13u1
  • xz-utils Debian 14 5.8.3-1

debian advisories DEBIAN-CVE-2026-34743

  • xz-utils Ubuntu 22.04 LTS 5.2.5-2ubuntu1.1
  • xz-utils Ubuntu 24.04 LTS 5.6.1+really5.4.5-1ubuntu0.3
  • xz-utils Ubuntu 25.10 5.8.1-1ubuntu0.1
  • xz-utils Ubuntu Pro 14.04 LTS 5.1.1alpha+20120614-2ubuntu2.14.04.1+esm2
  • xz-utils Ubuntu Pro 16.04 LTS 5.1.1alpha+20120614-2ubuntu2.16.04.1+esm2
  • xz-utils Ubuntu Pro 18.04 LTS 5.2.2-1.3ubuntu0.1+esm1
  • xz-utils Ubuntu Pro 20.04 LTS 5.2.4-1ubuntu1.1+esm1

ubuntu advisories UBUNTU-CVE-2026-34743

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • xz RHEL 10.2 1:5.6.2-4.el10_2.1
  • xz-libs RHEL 10.2 1:5.6.2-4.el10_2.1
  • xz-lzma-compat RHEL 10.2 1:5.6.2-4.el10_2.1
  • xz hummingbird 1 5.8.3-1.1.hum1
  • xz-libs hummingbird 1 5.8.3-1.1.hum1
  • xz-lzma-compat hummingbird 1 5.8.3-1.1.hum1

red hat advisories RHSA-2026:64787RHSA-2026:7647

  • xz openSUSE Tumbleweed 5.8.3-1.1

opensuse advisories openSUSE-SU-2026:10492-1

  • xz AlmaLinux 9 5.2.5-8.el9_8.1
  • xz-libs AlmaLinux 9 5.2.5-8.el9_8.1
  • xz-lzma-compat AlmaLinux 9 5.2.5-8.el9_8.1
  • xz AlmaLinux 10 1:5.6.2-4.el10_2.1
  • xz-libs AlmaLinux 10 1:5.6.2-4.el10_2.1
  • xz-lzma-compat AlmaLinux 10 1:5.6.2-4.el10_2.1

almalinux advisories ALSA-2026:89749ALSA-2026:64787

  • xz Rocky Linux 9 5.2.5-8.el9_8.1
  • xz Rocky Linux 10 1:5.6.2-4.el10_2.1

rocky linux advisories RLSA-2026:89749RLSA-2026:64787

  • xz Alpine 3.24, Alpine 3.23, Alpine 3.22 +2 more 5.8.3-r0

alpine advisories ALPINE-CVE-2026-34743

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • xz Azure Linux 3.0 5.4.4-3
  • rust Azure Linux 3.0 1.75.0-28
  • rust Azure Linux 3.0 1.90.0-7

azure linux advisories AZL-81800AZL-81905AZL-81908

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-34743 updated cvss 5.3

xz: XZ Utils: Denial of Service via buffer overflow in index decoding

  • Red Hat Enterprise Linux 6 xz, xz-libs, xz-lzma-compat
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 7 xz, xz-libs, xz-compat-libs, xz-lzma-compat Red Hat Enterprise Linux 8 xz, xz-libs, xz-lzma-compat Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9
    affected: no fix available “Fix deferred”
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-core-bff-rhel9, rhoai/odh-dashboard-rhel9, rhoai/odh-mod-arch-maas-rhel9, rhoai/odh-mod-arch-automl-rhel9, rhoai/odh-mod-arch-gen-ai-rhel9, rhoai/odh-mod-arch-mlflow-rhel9, +6 more
    under investigation
  • Red Hat Cost Management On-Premise 1 costmanagement/costmanagement-ui-rhel10 1791460851
    fixed: vendor fix RHSA-2026:79357
  • Red Hat Discovery 2 discovery/discovery-ui-rhel9 1793733716, discovery/discovery-server-rhel9 1793734080
    fixed: vendor fix RHSA-2026:94802
  • Red Hat Enterprise Linux AppStream (v. 9) xz-lzma-compat 5.2.5-8.el9_8.1
    fixed: vendor fix RHSA-2026:89749
  • Red Hat Enterprise Linux AppStream (v. 10) xz-lzma-compat 5.6.2-4.el10_2.1
    fixed: vendor fix RHSA-2026:64787
  • Red Hat Enterprise Linux BaseOS (v. 9) xz 5.2.5-8.el9_8.1, xz-libs 5.2.5-8.el9_8.1
    fixed: vendor fix RHSA-2026:89749
show 3 more
  • Red Hat Enterprise Linux BaseOS (v. 10) xz 5.6.2-4.el10_2.1, xz-libs 5.6.2-4.el10_2.1
    fixed: vendor fix RHSA-2026:64787
  • Red Hat Hardened Images xz 5.8.3-1.1.hum1, xz-libs 5.8.3-1.1.hum1, xz-lzma-compat 5.8.3-1.1.hum1
    fixed: vendor fix RHSA-2026:7647
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-mlflow-rhel9, rhoai/odh-kube-rbac-proxy-rhel9, rhoai/odh-maas-controller-rhel9, rhoai/odh-mlflow-operator-rhel9, rhoai/odh-model-controller-rhel9, rhoai/odh-ogx-k8s-operator-rhel9, +14 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
7 mo ago

Exploit prediction

0.53% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 1.7 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
CNA 4.0 1.7 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
OSV 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected packages

ecosystem package affected fixed in
julia XZ_jll
<5.8.3+0
5.8.3+0

Affected products

  • tukaani-project xz

Classification

Weakness
  • CWE-122 Heap-based Buffer Overflow

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.