PT-2025-14778 · Liblzma+8 · Liblzma+8
Published
2025-03-31
·
Updated
2025-11-14
·
CVE-2025-31115
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
XZ Utils versions 5.3.3alpha through 5.8.0
Description
The multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects include heap use after free and writing to an address based on the null pointer plus an offset. Applications and libraries that use the
lzma stream decoder mt function are affected.Recommendations
To resolve the issue, update to XZ Utils version 5.8.1 or later. A standalone patch is also available for all affected releases. As a temporary workaround, consider disabling the
lzma stream decoder mt function until a patch is available. Restrict access to the vulnerable liblzma library to minimize the risk of exploitation. Avoid using the lzma stream decoder mt function in affected API endpoints until the issue is resolved.Exploit
Fix
RCE
DoS
NULL Pointer Dereference
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Debian
Freebsd
Linuxmint
Suse
Ubuntu
Xz Utils
Liblzma