Skip to content

GHSA-5qpq-xqfv-j9pg on Cyberus Linux 26.05

Aliases: GHSA-5qpq-xqfv-j9pg

Packages: xz

Status: Resolved

Advisory Information

In XZ Utils 5.8.3 and older, an invalid memory write can occur in decoders that are initialized using the following functions:

  • lzma_alone_decoder (decodes .lzma files)
  • lzma_lzip_decoder (decodes .lz files)
  • lzma_auto_decoder (when decoding .lzma or .lz files)
  • lzma_microlzma_decoder (decodes MicroLZMA format)

Required steps: 1. A lzma_stream is initialized using one of the above functions. 2. A file is decoded at least partially. 3. The same lzma_stream is reinitialized using the same function. 4. Another file is decoded but memory allocation fails with LZMA_MEM_ERROR. (LZMA_MEMLIMIT_ERROR doesn't cause this.) 5. The same lzma_stream is reinitialized again using the same function. 6. A file is decoded. It must specify the same dictionary size as the file in step 2.

Decoders for the .xz format and raw streams aren't affected.

The issue has been fixed in XZ Utils 5.8.4 and in the Git repository branch v5.8. The fix is also in the Git repository branches v5.6, v5.4, and v5.2, but no new releases will be made from these old branches.

The bug was reported and discovered by Cantina using their AppSec agent, Apex.

Updates

2026-09-21 22:06 CEST

Metadata changes:

  • Status for package xz: “Resolved” (34845fafd0a22719db66d2a43c4d02c7970ab53a)

2026-09-15 16:32 CEST

Metadata changes:

  • Status for package xz: “In Progress” (34845fafd0a22719db66d2a43c4d02c7970ab53a)

(Amended on: 2026-09-15 16:39 CEST)

2026-09-10 21:51 CEST

Metadata changes:

  • Status for package xz: “Plausible”

2026-09-10 21:46 CEST

Metadata changes:

  • Status for package xz: “New”