Junglewise Threat Intelligence

CVE-2026-34743: Tukaani XZ Utils heap buffer overflow in lzma_index_append

CVE-2026-34743 · Severity: medium · CVSS 5.3 · Published 2026-04-02

Executive brief

XZ Utils is a widely used data compression library and set of command-line tools. A vulnerability was found where processing a specially crafted, empty index could cause a memory error (buffer overflow) if an application subsequently tries to add data to that index. While this could potentially cause a program to crash, it is considered low risk because most real-world applications do not perform the specific sequence of actions required to trigger the bug.

Technical details

A heap-based buffer overflow exists in XZ Utils (liblzma) due to an invalid internal 'prealloc' state. When lzma_index_decoder() processes an Index containing no Records, it fails to properly initialize the preallocation value. A subsequent call to lzma_index_append() on that same index object will then allocate insufficient memory, leading to a buffer overflow. The vulnerability is reachable if an application accepts untrusted compressed data and uses the affected API functions in a specific sequence. The issue is patched in version 5.8.3; while older branches (5.2, 5.4, 5.6) are also affected, users are advised to update to the latest stable release or apply the specific commits to their respective branches.

Affected products

  • tukaani-project xz-utils >= 5.0.0, < 5.8.3

Timeline

  • 2026-03-31: patched: Fixed in version 5.8.3 and backported to older branches in Git.
  • 2026-03-31: advisory: Vendor advisory GHSA-x872-m794-cxhv published.
  • 2026-04-02: disclosed: CVE-2026-34743 published to NVD.
  • 2026-07-21: other: Debian LTS advisory DLA-4690-1 released.

References

Related threats