USN-8945-1
xz-utils vulnerability
It was discovered that XZ Utils incorrectly handled certain memory allocation failures when reinitializing decoders for specific compressed file formats. An attacker could possibly use this issue to trigger an invalid memory write, resulting in a denial of service or arbitrary code execution.
What each source reports
OSV No score
xz-utils vulnerability
It was discovered that XZ Utils incorrectly handled certain memory allocation failures when reinitializing decoders for specific compressed file formats. An attacker could possibly use this issue to trigger an invalid memory write, resulting in a denial of service or arbitrary code execution.
- Record
USN-8945-1- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xz-utilsUbuntu:Pro:14.04:LTS |
before 5.1.1alpha+20120614-2ubuntu2.14.04.1+esm3, plus listed versions 5.1.1alpha+20120614-2ubuntu15.1.1alpha+20120614-2ubuntu25.1.1alpha+20120614-2ubuntu2.14.04.1+esm15.1.1alpha+20120614-2ubuntu2.14.04.1+esm2 |
5.1.1alpha+20120614-2ubuntu2.14.04.1+esm3 |
xz-utilsUbuntu:Pro:16.04:LTS |
before 5.1.1alpha+20120614-2ubuntu2.16.04.1+esm3, plus listed versions 5.1.1alpha+20120614-2ubuntu25.1.1alpha+20120614-2ubuntu2.16.04.1+esm15.1.1alpha+20120614-2ubuntu2.16.04.1+esm2 |
5.1.1alpha+20120614-2ubuntu2.16.04.1+esm3 |
xz-utilsUbuntu:Pro:18.04:LTS |
before 5.2.2-1.3ubuntu0.1+esm2, plus listed versions 5.2.2-1.35.2.2-1.3ubuntu0.15.2.2-1.3ubuntu0.1+esm1 |
5.2.2-1.3ubuntu0.1+esm2 |
xz-utilsUbuntu:Pro:20.04:LTS |
before 5.2.4-1ubuntu1.1+esm2, plus listed versions 5.2.4-15.2.4-1ubuntu15.2.4-1ubuntu1.15.2.4-1ubuntu1.1+esm1 |
5.2.4-1ubuntu1.1+esm2 |
xz-utilsUbuntu:22.04:LTS |
before 5.2.5-2ubuntu1.2, plus listed versions 5.2.5-25.2.5-2build15.2.5-2build25.2.5-2ubuntu15.2.5-2ubuntu1.1 |
5.2.5-2ubuntu1.2 |
xz-utilsUbuntu:24.04:LTS |
before 5.6.1+really5.4.5-1ubuntu0.4, plus listed versions 5.4.1-0.25.4.4-0.15.4.5-0.15.4.5-0.35.6.0-0.2 Show 4 moreShow less5.6.1+really5.4.5-15.6.1+really5.4.5-1build0.15.6.1+really5.4.5-1ubuntu0.25.6.1+really5.4.5-1ubuntu0.3 |
5.6.1+really5.4.5-1ubuntu0.4 |
xz-utilsUbuntu:26.10 |
before 5.8.3-1ubuntu1, plus listed versions 5.8.3-1 |
5.8.3-1ubuntu1 |
xz-utilsUbuntu:26.04:LTS |
before 5.8.3-1ubuntu0.1, plus listed versions 5.8.1-1build25.8.1-25.8.2-15.8.2-25.8.3-1 |
5.8.3-1ubuntu0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
USN-8945-1 is a vulnerability with no CVSS score yet in xz-utils, published October 20, 2026. No source lists public exploit code. Fixed in xz-utils 5.1.1alpha+20120614-2ubuntu2.14.04.1+esm3.