Executive brief
XZ Utils is a widely used data compression library and set of command-line tools found in many Linux distributions and software packages. A vulnerability in its multithreaded decompression feature allows a specially crafted file to crash the application or potentially allow unauthorized memory access. This could lead to service outages or, in specific environments, allow an attacker to gain further control over the system.
Technical details
A race condition and premature resource release exists in the liblzma multithreaded .xz decoder (specifically the lzma_stream_decoder_mt function). When processing invalid input, a worker thread may free an input buffer while the main thread is still attempting to write to it. This results in a heap use-after-free or a write to an address based on a null pointer plus an offset. While primarily resulting in a denial-of-service (crash), exploitation may be possible on 32-bit systems without Position Independent Executable (PIE) protections. The issue is fixed in XZ Utils 5.8.1 and via standalone patches for older branches.
Affected products
- Tukaani Project XZ Utils 5.3.3alpha to 5.8.0
Timeline
- 2025-03-31: disclosed: Privately communicated to distributions mailing list
- 2025-04-03: advisory: Public disclosure and CVE assignment
- 2025-04-03: patched: Fixed in version 5.8.1
References
- https://github.com/tukaani-project/xz/commit/d5a2ffe41bb77b918a8c96084885d4dbe4bf6480
- https://github.com/tukaani-project/xz/security/advisories/GHSA-6cc8-p5mm-29w2
- https://tukaani.org/xz/xz-cve-2025-31115.patch
- http://www.openwall.com/lists/oss-security/2025/04/03/1
- http://www.openwall.com/lists/oss-security/2025/04/03/2
- http://www.openwall.com/lists/oss-security/2025/04/03/3
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html