Every CVE Search/ Get API key

CVE-2026-34743

XZ Utils: Buffer overflow in lzma_index_append()

1.7 LowFix available

XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.53%Up 0.5 points since Apr 3, 2026
90%50%10%1%

What each source reports

CVE List Score used 1.7

XZ Utils: Buffer overflow in lzma_index_append()

XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.

Record
CVE-2026-34743
CVSS 4.0
1.7 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
Weakness
CWE-122
Updated
2026-11-02
EUVDEUVD-2026-18505 1.7

XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.

Record
EUVD-2026-18505
CVSS 4.0
1.7 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
Updated
2026-11-02
NVD 1.7

XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.

Record
CVE-2026-34743
CVSS 4.0
1.7 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-122
Updated
2026-11-02
OSVALPINE-CVE-2026-34743 5.3

XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.

Record
ALPINE-CVE-2026-34743
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVBELL-CVE-2026-34743 5.3
Record
BELL-CVE-2026-34743
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSV 1.7

XZ Utils: Buffer overflow in lzma_index_append()

XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.

Record
CVE-2026-34743
CVSS 4.0
1.7 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
Weakness
CWE-122
Updated
2026-11-02
Show 29 moreShow less
OSVDEBIAN-CVE-2026-34743 5.3

XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.

Record
DEBIAN-CVE-2026-34743
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVJLSEC-2026-462 1.7

XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.

Record
JLSEC-2026-462
CVSS 4.0
1.7 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2026-1853 9.8

xz security update

XZ Utils is free general-purpose data compression software with a high compression ratio. XZ Utils were written for POSIX-like systems, but also work on some not-so-POSIX systems. XZ Utils are the successor to LZMA Utils.

Security Fix(es):

XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.(CVE-2026-34743)

Record
OESA-2026-1853
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:64787 5.3

Red Hat Security Advisory: xz security update

Record
RHSA-2026:64787
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRHSA-2026:7647 5.3

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:7647
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRLSA-2026:64787 5.3

Moderate: xz security update

XZ Utils is an integrated collection of user-space file compression utilities based on the Lempel-Ziv-Markov chain algorithm (LZMA), which performs lossless data compression. The algorithm provides a high compression ratio while keeping the decompression time short.

Security Fix(es):

  • xz: XZ Utils: Denial of Service via buffer overflow in index decoding (CVE-2026-34743)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:64787
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRLSA-2026:89749 5.3

Moderate: xz security update

XZ Utils is an integrated collection of user-space file compression utilities based on the Lempel-Ziv-Markov chain algorithm (LZMA), which performs lossless data compression. The algorithm provides a high compression ratio while keeping the decompression time short.

Security Fix(es):

  • xz: XZ Utils: Denial of Service via buffer overflow in index decoding (CVE-2026-34743)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:89749
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVROOT-OS-DEBIAN-11-CVE-2026-34743 5.3

CVE-2026-34743 in xz-utils - Patched by Root

Root has patched CVE-2026-34743 in the xz-utils package for Root:Debian:11. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-11-CVE-2026-34743
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2026-34743 5.3

CVE-2026-34743 in xz-utils - Patched by Root

Root has patched CVE-2026-34743 in the xz-utils package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2026-34743
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2026-34743 5.3

CVE-2026-34743 in rootio-xz-utils - Patched by Root

Root has patched CVE-2026-34743 in the rootio-xz-utils package for Root:Debian:13. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-13-CVE-2026-34743
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2026-34743 1.7

XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.

Record
UBUNTU-CVE-2026-34743
CVSS 4.0
1.7 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVALSA-2026:64787 No score

Moderate: xz security update

XZ Utils is an integrated collection of user-space file compression utilities based on the Lempel-Ziv-Markov chain algorithm (LZMA), which performs lossless data compression. The algorithm provides a high compression ratio while keeping the decompression time short.

Security Fix(es):

  • xz: XZ Utils: Denial of Service via buffer overflow in index decoding (CVE-2026-34743)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:64787
Updated
2026-11-02
OSVALSA-2026:89749 No score

Moderate: xz security update

XZ Utils is an integrated collection of user-space file compression utilities based on the Lempel-Ziv-Markov chain algorithm (LZMA), which performs lossless data compression. The algorithm provides a high compression ratio while keeping the decompression time short.

Security Fix(es):

  • xz: XZ Utils: Denial of Service via buffer overflow in index decoding (CVE-2026-34743)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:89749
Updated
2026-11-02
OSVAZL-81800 No score

CVE-2026-34743 affecting package xz for versions less than 5.4.4-3

XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.

Record
AZL-81800
Updated
2026-11-02
OSVAZL-81905 No score

CVE-2026-34743 affecting package rust for versions less than 1.75.0-28

XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.

Record
AZL-81905
Updated
2026-11-02
OSVAZL-81908 No score

CVE-2026-34743 affecting package rust for versions less than 1.90.0-7

XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.

Record
AZL-81908
Updated
2026-11-02
OSVCLSA-2026-1779894244 No score

xz: Fix of CVE-2026-34743

  • CVE-2026-34743: fix buffer overflow in lzma_index_append
Record
CLSA-2026-1779894244
Updated
2026-11-02
OSVCLSA-2026-1780518704 No score

xz: Fix of CVE-2026-34743

  • CVE-2026-34743: fix buffer overflow in lzma_index_append
Record
CLSA-2026-1780518704
Updated
2026-11-02
OSVMGASA-2026-0084 No score

Updated xz packages fix security vulnerability

Buffer overflow in lzma_index_append(). (CVE-2026-34743)

Record
MGASA-2026-0084
Updated
2026-11-02
OSVopenSUSE-SU-2026:10492-1 No score

liblzma5-32bit-5.8.3-1.1 on GA media

These are all security issues fixed in the liblzma5-32bit-5.8.3-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10492-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20813-1 No score

Security update for xz

This update for xz fixes the following issue

  • CVE-2026-34743: buffer overflow in lzma_index_append() (bsc#1261280).
Record
openSUSE-SU-2026:20813-1
Updated
2026-11-02
OSVSUSE-SU-2026:2051-1 No score

Security update for xz

This update for xz fixes the following issue

  • CVE-2026-34743: buffer overflow in lzma_index_append() (bsc#1261280).
Record
SUSE-SU-2026:2051-1
Updated
2026-11-02
OSVSUSE-SU-2026:2052-1 No score

Security update for xz

This update for xz fixes the following issue

  • CVE-2026-34743: buffer overflow in lzma_index_append() (bsc#1261280).
Record
SUSE-SU-2026:2052-1
Updated
2026-11-02
OSVSUSE-SU-2026:2118-1 No score

Security update for xz

This update for xz fixes the following issue

  • CVE-2026-34743: buffer overflow in lzma_index_append() (bsc#1261280).
Record
SUSE-SU-2026:2118-1
Updated
2026-11-02
OSVSUSE-SU-2026:21729-1 No score

Security update for xz

This update for xz fixes the following issue

  • CVE-2026-34743: buffer overflow in lzma_index_append() (bsc#1261280).
Record
SUSE-SU-2026:21729-1
Updated
2026-11-02
OSVSUSE-SU-2026:21740-1 No score

Security update for xz

This update for xz fixes the following issue

  • CVE-2026-34743: buffer overflow in lzma_index_append() (bsc#1261280).
Record
SUSE-SU-2026:21740-1
Updated
2026-11-02
OSVSUSE-SU-2026:21835-1 No score

Security update for xz

This update for xz fixes the following issue

  • CVE-2026-34743: buffer overflow in lzma_index_append() (bsc#1261280).
Record
SUSE-SU-2026:21835-1
Updated
2026-11-02
OSVSUSE-SU-2026:21848-1 No score

Security update for xz

This update for xz fixes the following issue

  • CVE-2026-34743: buffer overflow in lzma_index_append() (bsc#1261280).
Record
SUSE-SU-2026:21848-1
Updated
2026-11-02
OSVUSN-8362-1 No score

xz-utils vulnerability

It was discovered that XZ Utils did not properly manage memory when attempting to append data to a decoded index that contained no records. An attacker could possibly use this issue to cause XZ Utils to crash, resulting in a denial of service, or execute arbitrary code.

Record
USN-8362-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
xz
Alpine:v3.20
 before 5.8.3-r0
5.8.3-r0
xz
Alpine:v3.21
 before 5.8.3-r0
5.8.3-r0
xz
Alpine:v3.22
 before 5.8.3-r0
5.8.3-r0
xz
Alpine:v3.23
 before 5.8.3-r0
5.8.3-r0
xz
Alpine:v3.24
 before 5.8.3-r0
5.8.3-r0
xz
AlmaLinux:10
 before 1:5.6.2-4.el10_2.1
1:5.6.2-4.el10_2.1
xz-devel
AlmaLinux:10
 before 1:5.6.2-4.el10_2.1
1:5.6.2-4.el10_2.1
xz-libs
AlmaLinux:10
 before 1:5.6.2-4.el10_2.1
1:5.6.2-4.el10_2.1
xz-lzma-compat
AlmaLinux:10
 before 1:5.6.2-4.el10_2.1
1:5.6.2-4.el10_2.1
xz
AlmaLinux:9
 before 5.2.5-8.el9_8.1
5.2.5-8.el9_8.1
Show 56 moreShow less
Affected packages
PackageAffectedFixed
xz-devel
AlmaLinux:9
 before 5.2.5-8.el9_8.1
5.2.5-8.el9_8.1
xz-libs
AlmaLinux:9
 before 5.2.5-8.el9_8.1
5.2.5-8.el9_8.1
xz-lzma-compat
AlmaLinux:9
 before 5.2.5-8.el9_8.1
5.2.5-8.el9_8.1
xz
Azure Linux:3
 before 5.4.4-3
5.4.4-3
rust
Azure Linux:3
 before 1.75.0-28
1.75.0-28
rust
Azure Linux:3
 1.85.0 up to 1.90.0-7
1.90.0-7
xz
Alpaquita:23
 5.2.8-r0 up to 5.2.9_p525-r1
5.2.9_p525-r1
xz
Alpaquita:25
 5.8.1-r0 up to 5.8.3-r0
5.8.3-r0
xz
Alpaquita:stream
 5.4.1-r0 up to 5.8.3-r0
5.8.3-r0
xz
BellSoft Hardened Containers:23
 5.2.8-r0 up to 5.2.9_p525-r1
5.2.9_p525-r1
xz
BellSoft Hardened Containers:25
 5.8.1-r0 up to 5.8.3-r0
5.8.3-r0
xz
BellSoft Hardened Containers:stream
 5.4.1-r0 up to 5.8.3-r0
5.8.3-r0
xz
TuxCare:AlmaLinux:9.2
 before 5.2.5-8.tuxcare.els1
5.2.5-8.tuxcare.els1
xz-devel
TuxCare:AlmaLinux:9.2
 before 5.2.5-8.tuxcare.els1
5.2.5-8.tuxcare.els1
xz-libs
TuxCare:AlmaLinux:9.2
 before 5.2.5-8.tuxcare.els1
5.2.5-8.tuxcare.els1
xz-lzma-compat
TuxCare:AlmaLinux:9.2
 before 5.2.5-8.tuxcare.els1
5.2.5-8.tuxcare.els1
xz-static
TuxCare:AlmaLinux:9.2
 before 5.2.5-8.tuxcare.els1
5.2.5-8.tuxcare.els1
xz
TuxCare:AlmaLinux:9.6
 before 5.2.5-8.el9_6.tuxcare.els1
5.2.5-8.el9_6.tuxcare.els1
xz-devel
TuxCare:AlmaLinux:9.6
 before 5.2.5-8.el9_6.tuxcare.els1
5.2.5-8.el9_6.tuxcare.els1
xz-libs
TuxCare:AlmaLinux:9.6
 before 5.2.5-8.el9_6.tuxcare.els1
5.2.5-8.el9_6.tuxcare.els1
xz-lzma-compat
TuxCare:AlmaLinux:9.6
 before 5.2.5-8.el9_6.tuxcare.els1
5.2.5-8.el9_6.tuxcare.els1
xz-static
TuxCare:AlmaLinux:9.6
 before 5.2.5-8.el9_6.tuxcare.els1
5.2.5-8.el9_6.tuxcare.els1
xz-utils
Debian:12
 before 5.4.1-1+deb12u1, plus listed versions
5.4.1-0.25.4.1-1
5.4.1-1+deb12u1
xz-utils
Debian:13
 before 5.8.1-1+deb13u1, plus listed versions
5.8.1-1
5.8.1-1+deb13u1
xz-utils
Debian:14
 before 5.8.3-1, plus listed versions
5.8.1-15.8.1-1.15.8.1-25.8.2-15.8.2-2
5.8.3-1
XZ_jll
Julia
 before 5.8.3+0
5.8.3+0
xz
Mageia:9
 before 5.4.3-1.2.mga9
5.4.3-1.2.mga9
xz
openEuler:20.03-LTS-SP4
 before 5.2.5-5.oe2003sp4
5.2.5-5.oe2003sp4
xz
openEuler:22.03-LTS-SP4
 before 5.2.5-5.oe2203sp4
5.2.5-5.oe2203sp4
xz
openEuler:24.03-LTS
 before 5.4.7-8.oe2403sp3
5.4.7-8.oe2403sp3
xz
openEuler:24.03-LTS-SP1
 before 5.4.7-8.oe2403sp1
5.4.7-8.oe2403sp1
xz
openEuler:24.03-LTS-SP2
 before 5.4.7-8.oe2403sp2
5.4.7-8.oe2403sp2
xz
openEuler:24.03-LTS-SP3
 before 5.4.7-8.oe2403sp3
5.4.7-8.oe2403sp3
xz-debuginfo
Red Hat:enterprise_linux:10.2
 before 1:5.6.2-4.el10_2.1
1:5.6.2-4.el10_2.1
xz-debugsource
Red Hat:enterprise_linux:10.2
 before 1:5.6.2-4.el10_2.1
1:5.6.2-4.el10_2.1
xz-devel
Red Hat:enterprise_linux:10.2
 before 1:5.6.2-4.el10_2.1
1:5.6.2-4.el10_2.1
xz-libs-debuginfo
Red Hat:enterprise_linux:10.2
 before 1:5.6.2-4.el10_2.1
1:5.6.2-4.el10_2.1
xz-lzma-compat
Red Hat:enterprise_linux:10.2
 before 1:5.6.2-4.el10_2.1
1:5.6.2-4.el10_2.1
xz-lzma-compat-debuginfo
Red Hat:enterprise_linux:10.2
 before 1:5.6.2-4.el10_2.1
1:5.6.2-4.el10_2.1
xz
Red Hat:enterprise_linux:10.2
 before 1:5.6.2-4.el10_2.1
1:5.6.2-4.el10_2.1
xz-libs
Red Hat:enterprise_linux:10.2
 before 1:5.6.2-4.el10_2.1
1:5.6.2-4.el10_2.1
xz
Red Hat:hummingbird:1
 before 0:5.8.3-1.1.hum1
0:5.8.3-1.1.hum1
xz-devel
Red Hat:hummingbird:1
 before 0:5.8.3-1.1.hum1
0:5.8.3-1.1.hum1
xz-libs
Red Hat:hummingbird:1
 before 0:5.8.3-1.1.hum1
0:5.8.3-1.1.hum1
xz-lzma-compat
Red Hat:hummingbird:1
 before 0:5.8.3-1.1.hum1
0:5.8.3-1.1.hum1
xz-static
Red Hat:hummingbird:1
 before 0:5.8.3-1.1.hum1
0:5.8.3-1.1.hum1
xz
Rocky Linux:10
 before 1:5.6.2-4.el10_2.1
1:5.6.2-4.el10_2.1
xz
Rocky Linux:9
 before 0:5.2.5-8.el9_8.1
0:5.2.5-8.el9_8.1
xz-utils
Ubuntu:Pro:14.04:LTS
 before 5.1.1alpha+20120614-2ubuntu2.14.04.1+esm2, plus listed versions
5.1.1alpha+20120614-2ubuntu15.1.1alpha+20120614-2ubuntu25.1.1alpha+20120614-2ubuntu2.14.04.1+esm1
5.1.1alpha+20120614-2ubuntu2.14.04.1+esm2
xz-utils
Ubuntu:Pro:16.04:LTS
 before 5.1.1alpha+20120614-2ubuntu2.16.04.1+esm2, plus listed versions
5.1.1alpha+20120614-2ubuntu25.1.1alpha+20120614-2ubuntu2.16.04.1+esm1
5.1.1alpha+20120614-2ubuntu2.16.04.1+esm2
xz-utils
Ubuntu:Pro:18.04:LTS
 before 5.2.2-1.3ubuntu0.1+esm1, plus listed versions
5.2.2-1.35.2.2-1.3ubuntu0.1
5.2.2-1.3ubuntu0.1+esm1
xz-utils
Ubuntu:Pro:20.04:LTS
 before 5.2.4-1ubuntu1.1+esm1, plus listed versions
5.2.4-15.2.4-1ubuntu15.2.4-1ubuntu1.1
5.2.4-1ubuntu1.1+esm1
xz-utils
Ubuntu:22.04:LTS
 before 5.2.5-2ubuntu1.1, plus listed versions
5.2.5-25.2.5-2build15.2.5-2build25.2.5-2ubuntu1
5.2.5-2ubuntu1.1
xz-utils
Ubuntu:24.04:LTS
 before 5.6.1+really5.4.5-1ubuntu0.3, plus listed versions
5.4.1-0.25.4.4-0.15.4.5-0.15.4.5-0.35.6.0-0.25.6.1+really5.4.5-15.6.1+really5.4.5-1build0.15.6.1+really5.4.5-1ubuntu0.2
5.6.1+really5.4.5-1ubuntu0.3
xz-utils
Ubuntu:25.10
 before 5.8.1-1ubuntu0.1, plus listed versions
5.6.4-1ubuntu15.8.1-15.8.1-1build15.8.1-1build2
5.8.1-1ubuntu0.1
xz
openSUSE:Tumbleweed
 before 5.8.3-1.1
5.8.3-1.1

History

History
RecordedChangedSources
affected
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-34743 is a low vulnerability (CVSS 1.7) in Tukaani Xz, published April 2, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.53%, the 45th percentile. Fixed in xz 5.8.3-r0.

References

Show 36 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open