XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.
References
| Link | Resource |
|---|---|
| https://github.com/tukaani-project/xz/commit/c8c22869e780ff57c96b46939c3d79ff99395f87 | Patch |
| https://github.com/tukaani-project/xz/releases/tag/v5.8.3 | Product Release Notes |
| https://github.com/tukaani-project/xz/security/advisories/GHSA-x872-m794-cxhv | Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2026/03/31/13 | Mailing List Patch Third Party Advisory |
Configurations
History
15 Apr 2026, 17:33
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/tukaani-project/xz/commit/c8c22869e780ff57c96b46939c3d79ff99395f87 - Patch | |
| References | () https://github.com/tukaani-project/xz/releases/tag/v5.8.3 - Product, Release Notes | |
| References | () https://github.com/tukaani-project/xz/security/advisories/GHSA-x872-m794-cxhv - Vendor Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2026/03/31/13 - Mailing List, Patch, Third Party Advisory | |
| First Time |
Tukaani
Tukaani xz |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.3 |
| CPE | cpe:2.3:a:tukaani:xz:*:*:*:*:*:*:*:* |
02 Apr 2026, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
02 Apr 2026, 19:21
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-02 19:21
Updated : 2026-04-15 17:33
NVD link : CVE-2026-34743
Mitre link : CVE-2026-34743
CVE.ORG link : CVE-2026-34743
JSON object : View
Products Affected
tukaani
- xz
CWE
CWE-122
Heap-based Buffer Overflow