{"id":"CVE-2025-31115","aliases":["ALPINE-CVE-2025-31115","ALSA-2025:7524","AZL-59497","BELL-CVE-2025-31115","DEBIAN-CVE-2025-31115","DSA-5895-1","EUVD-2025-14786","GHSA-6cc8-p5mm-29w2","HSEC-2025-0003","MGASA-2025-0131","OESA-2025-1430","OESA-2025-1431","RHSA-2025:7524","RLSA-2025:7524","SUSE-SU-2025:1137-1","SUSE-SU-2025:20553-1","SUSE-SU-2025:20590-1","UBUNTU-CVE-2025-31115","USN-7414-1","openSUSE-SU-2025:14984-1"],"status":"published","title":"XZ has a heap-use-after-free bug in threaded .xz decoder","description":"XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects include heap use after free and writing to an address based on the null pointer plus an offset. Applications and libraries that use the lzma_stream_decoder_mt function are affected. The bug has been fixed in XZ Utils 5.8.1, and the fix has been committed to the v5.4, v5.6, v5.8, and master branches in the xz Git repository. No new release packages will be made from the old stable branches, but a standalone patch is available that applies to all affected releases.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00675,"percentile":0.52702,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-366","CWE-416","CWE-476","CWE-826"],"published":"2025-04-03T15:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.18","package":"xz","fixed_in":["5.4.3-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"xz","fixed_in":["5.4.5-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"xz","fixed_in":["5.6.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"xz","fixed_in":["5.6.3-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"xz","fixed_in":["5.8.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"xz","fixed_in":["5.8.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"xz","fixed_in":["5.8.1-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"xz","fixed_in":["1:5.6.2-4.el10_0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"xz-devel","fixed_in":["1:5.6.2-4.el10_0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"xz-libs","fixed_in":["1:5.6.2-4.el10_0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"xz-lzma-compat","fixed_in":["1:5.6.2-4.el10_0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"xz","fixed_in":["5.4.4-2"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"xz","fixed_in":["5.8.1-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"xz","fixed_in":["5.8.1-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"xz-utils","fixed_in":["5.4.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xz-utils","fixed_in":["5.8.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xz-utils","fixed_in":["5.8.1-1"],"sources":["osv"]},{"ecosystem":"Hackage","package":"xz-clib","fixed_in":["5.8.1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"xz","fixed_in":["5.4.3-1.1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"xz","fixed_in":["5.4.7-5.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"xz","fixed_in":["5.4.7-5.oe2403sp1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"xz-debuginfo","fixed_in":["1:5.6.2-4.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"xz-debugsource","fixed_in":["1:5.6.2-4.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"xz-devel","fixed_in":["1:5.6.2-4.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"xz-libs-debuginfo","fixed_in":["1:5.6.2-4.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"xz-lzma-compat","fixed_in":["1:5.6.2-4.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"xz-lzma-compat-debuginfo","fixed_in":["1:5.6.2-4.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"xz","fixed_in":["1:5.6.2-4.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"xz-libs","fixed_in":["1:5.6.2-4.el10_0"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"xz","fixed_in":["1:5.6.2-4.el10_0"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"xz","fixed_in":["5.4.1-150600.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"xz","fixed_in":["5.4.1-150600.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"xz","fixed_in":["5.4.3-5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"xz","fixed_in":["5.4.3-slfo.1.1_2.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"xz-utils","fixed_in":["5.6.1+really5.4.5-1ubuntu0.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"xz","fixed_in":["5.8.1-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.18","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.3-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.5-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.3-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.1-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.6.2-4.el10_0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"xz-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.6.2-4.el10_0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"xz-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.6.2-4.el10_0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"xz-lzma-compat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.6.2-4.el10_0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.4-2"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.1-r0"},{"fixed":"5.8.1-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.1-r0"},{"fixed":"5.8.1-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"xz-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.1-1"}]}],"versions":["5.4.1-0.2"]},{"source":"osv","ecosystem":"Debian:13","package":"xz-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"xz-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.1-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"xz-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.1-1"}]}],"versions":["5.4.1-0.2"]},{"source":"osv","ecosystem":"Hackage","package":"xz-clib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.3"},{"fixed":"5.8.1"}]}],"versions":["5.6.3","5.6.4","5.8.0","5.8.0.1"]},{"source":"osv","ecosystem":"Mageia:9","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.3-1.1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.7-5.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.7-5.oe2403sp1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"xz-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.6.2-4.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"xz-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.6.2-4.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"xz-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.6.2-4.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"xz-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.6.2-4.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"xz-lzma-compat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.6.2-4.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"xz-lzma-compat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.6.2-4.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.6.2-4.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"xz-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.6.2-4.el10_0"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.6.2-4.el10_0"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.1-150600.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.1-150600.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.3-5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.3-slfo.1.1_2.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"xz-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1+really5.4.5-1ubuntu0.2"}]}],"versions":["5.4.1-0.2","5.4.4-0.1","5.4.5-0.1","5.4.5-0.3","5.6.0-0.2","5.6.1+really5.4.5-1","5.6.1+really5.4.5-1build0.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"xz-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1+really5.4.5-1ubuntu0.2"}]}],"versions":["5.4.1-0.2","5.4.4-0.1","5.4.5-0.1","5.4.5-0.3","5.6.0-0.2","5.6.1+really5.4.5-1","5.6.1+really5.4.5-1build0.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.1-1.1"}]}]}],"products":[{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"tukaani-project","product":"xz"}],"references":[{"url":"https://github.com/tukaani-project/xz/security/advisories/GHSA-6cc8-p5mm-29w2","tags":["x_refsource_CONFIRM","advisory","article"]},{"url":"https://github.com/tukaani-project/xz/commit/d5a2ffe41bb77b918a8c96084885d4dbe4bf6480","tags":["x_refsource_MISC","fix","article"]},{"url":"https://tukaani.org/xz/xz-cve-2025-31115.patch","tags":["x_refsource_MISC","web","article"]},{"url":"http://www.openwall.com/lists/oss-security/2025/04/03/1","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/04/03/2","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/04/03/3","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-31115","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:7524","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-31115","tags":["report"]},{"url":"https://bugzilla.redhat.com/2357249","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2025-7524.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-31115","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-31115","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31115.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-31115","tags":["advisory"]},{"url":"https://tukaani.org/xz/threaded-decoder-early-free.html","tags":["article"]},{"url":"https://github.com/hasufell/lzma-static/commit/e95fe96530568addfc83b771900025053e2c6951","tags":["fix"]},{"url":"https://advisories.mageia.org/MGASA-2025-0131.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34164","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2025/04/03/1","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1430","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1431","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2357249","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7524.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-31115","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2025:7524","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20251137-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1240414","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-31115","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520553-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520590-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-31115","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7414-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/P5GO5ENHURQSO7WJQXKN647RXXWTS24U/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-31115","title":"XZ has a heap-use-after-free bug in threaded .xz decoder","description":"XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects include heap use after free and writing to an address based on the null pointer plus an offset. Applications and libraries that use the lzma_stream_decoder_mt function are affected. The bug has been fixed in XZ Utils 5.8.1, and the fix has been committed to the v5.4, v5.6, v5.8, and master branches in the xz Git repository. No new release packages will be made from the old stable branches, but a standalone patch is available that applies to all affected releases.","status":"published","published":"2025-04-03T16:57:05.488Z","modified":"2026-10-15T01:06:00.051Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-366","CWE-416","CWE-476","CWE-826"],"updated_at":"2026-11-02T14:32:44.424933Z"}],"euvd":[{"id":"EUVD-2025-14786","description":"XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects include heap use after free and writing to an address based on the null pointer plus an offset. Applications and libraries that use the lzma_stream_decoder_mt function are affected. The bug has been fixed in XZ Utils 5.8.1, and the fix has been committed to the v5.4, v5.6, v5.8, and master branches in the xz Git repository. No new release packages will be made from the old stable branches, but a standalone patch is available that applies to all affected releases.","status":"published","published":"2025-04-03T16:57:05Z","modified":"2026-10-15T01:06:00Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:27:07.544788Z"}],"nvd":[{"id":"CVE-2025-31115","description":"XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects include heap use after free and writing to an address based on the null pointer plus an offset. Applications and libraries that use the lzma_stream_decoder_mt function are affected. The bug has been fixed in XZ Utils 5.8.1, and the fix has been committed to the v5.4, v5.6, v5.8, and master branches in the xz Git repository. No new release packages will be made from the old stable branches, but a standalone patch is available that applies to all affected releases.","status":"published","published":"2025-04-03T17:15:30.54Z","modified":"2026-06-17T09:09:52.91Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-366","CWE-416","CWE-476","CWE-826"],"updated_at":"2026-11-02T14:10:58.094557Z"}],"osv":[{"id":"ALPINE-CVE-2025-31115","description":"XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects include heap use after free and writing to an address based on the null pointer plus an offset. Applications and libraries that use the lzma_stream_decoder_mt function are affected. The bug has been fixed in XZ Utils 5.8.1, and the fix has been committed to the v5.4, v5.6, v5.8, and master branches in the xz Git repository. No new release packages will be made from the old stable branches, but a standalone patch is available that applies to all affected releases.","status":"published","published":"2025-04-03T17:15:30.54Z","modified":"2026-08-27T22:18:02.877790429Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"CVE-2025-31115","title":"XZ has a heap-use-after-free bug in threaded .xz decoder","description":"XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects include heap use after free and writing to an address based on the null pointer plus an offset. Applications and libraries that use the lzma_stream_decoder_mt function are affected. The bug has been fixed in XZ Utils 5.8.1, and the fix has been committed to the v5.4, v5.6, v5.8, and master branches in the xz Git repository. No new release packages will be made from the old stable branches, but a standalone patch is available that applies to all affected releases.","status":"published","published":"2025-04-03T16:57:05.488Z","modified":"2026-10-28T10:59:01.826175486Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-366","CWE-416","CWE-476","CWE-826"],"updated_at":"2026-11-02T15:44:48.02508Z"},{"id":"DEBIAN-CVE-2025-31115","description":"XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects include heap use after free and writing to an address based on the null pointer plus an offset. Applications and libraries that use the lzma_stream_decoder_mt function are affected. The bug has been fixed in XZ Utils 5.8.1, and the fix has been committed to the v5.4, v5.6, v5.8, and master branches in the xz Git repository. No new release packages will be made from the old stable branches, but a standalone patch is available that applies to all affected releases.","status":"published","published":"2025-04-03T17:15:30.54Z","modified":"2026-09-01T20:05:45.661941116Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:45:45.870237Z"},{"id":"OESA-2025-1430","title":"xz security update","description":"XZ Utils is free general-purpose data compression software with a high compression ratio. XZ Utils were written for POSIX-like systems, but also work on some not-so-POSIX systems. XZ Utils are the successor to LZMA Utils.\r\n\r\nSecurity Fix(es):\n\nXZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects include heap use after free and writing to an address based on the null pointer plus an offset. Applications and libraries that use the lzma_stream_decoder_mt function are affected. The bug has been fixed in XZ Utils 5.8.1, and the fix has been committed to the v5.4, v5.6, v5.8, and master branches in the xz Git repository. No new release packages will be made from the old stable branches, but a standalone patch is available that applies to all affected releases.(CVE-2025-31115)","status":"published","published":"2025-04-18T11:08:31Z","modified":"2026-08-18T01:18:45.785186457Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1431","title":"xz security update","description":"XZ Utils is free general-purpose data compression software with a high compression ratio. XZ Utils were written for POSIX-like systems, but also work on some not-so-POSIX systems. XZ Utils are the successor to LZMA Utils.\r\n\r\nSecurity Fix(es):\n\nXZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects include heap use after free and writing to an address based on the null pointer plus an offset. Applications and libraries that use the lzma_stream_decoder_mt function are affected. The bug has been fixed in XZ Utils 5.8.1, and the fix has been committed to the v5.4, v5.6, v5.8, and master branches in the xz Git repository. No new release packages will be made from the old stable branches, but a standalone patch is available that applies to all affected releases.(CVE-2025-31115)","status":"published","published":"2025-04-18T11:08:31Z","modified":"2026-08-18T01:18:17.275438617Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"RHSA-2025:7524","title":"Red Hat Security Advisory: xz security update","status":"published","published":"2025-05-14T10:06:48Z","modified":"2026-09-01T10:09:43Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RLSA-2025:7524","title":"Important: xz security update","description":"XZ Utils is an integrated collection of user-space file compression utilities based on the Lempel-Ziv-Markov chain algorithm (LZMA), which performs lossless data compression. The algorithm provides a high compression ratio while keeping the decompression time short.\n\nSecurity Fix(es):\n\n* xz: XZ has a heap-use-after-free bug in threaded .xz decoder (CVE-2025-31115)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-03T19:56:45.27031Z","modified":"2025-10-08T17:12:39.888976Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"UBUNTU-CVE-2025-31115","description":"XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects include heap use after free and writing to an address based on the null pointer plus an offset. Applications and libraries that use the lzma_stream_decoder_mt function are affected. The bug has been fixed in XZ Utils 5.8.1, and the fix has been committed to the v5.4, v5.6, v5.8, and master branches in the xz Git repository. No new release packages will be made from the old stable branches, but a standalone patch is available that applies to all affected releases.","status":"published","published":"2025-04-03T15:00:00Z","modified":"2026-04-22T15:41:41.240783Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:55:28.829873Z"},{"id":"ALSA-2025:7524","title":"Important: xz security update","description":"XZ Utils is an integrated collection of user-space file compression utilities based on the Lempel-Ziv-Markov chain algorithm (LZMA), which performs lossless data compression. The algorithm provides a high compression ratio while keeping the decompression time short.  \n\nSecurity Fix(es):  \n\n  * xz: XZ has a heap-use-after-free bug in threaded .xz decoder (CVE-2025-31115)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-05-13T00:00:00Z","modified":"2026-10-29T11:58:17.234901Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"AZL-59497","title":"CVE-2025-31115 affecting package xz for versions less than 5.4.4-2","description":"XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects include heap use after free and writing to an address based on the null pointer plus an offset. Applications and libraries that use the lzma_stream_decoder_mt function are affected. The bug has been fixed in XZ Utils 5.8.1, and the fix has been committed to the v5.4, v5.6, v5.8, and master branches in the xz Git repository. No new release packages will be made from the old stable branches, but a standalone patch is available that applies to all affected releases.","status":"published","published":"2025-04-03T17:15:30Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:21.344052Z"},{"id":"BELL-CVE-2025-31115","status":"published","published":"2025-04-04T05:57:55.872291Z","modified":"2026-01-26T09:39:07.231545Z","updated_at":"2026-11-02T15:28:21.741325Z"},{"id":"DSA-5895-1","title":"xz-utils - security update","status":"published","published":"2025-04-05T00:00:00Z","modified":"2026-03-09T02:08:52.515269Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"HSEC-2025-0003","title":"Use after free in multithreaded lzma (.xz) decoder","description":"# Use after free in multithreaded lzma (.xz) decoder\n\nIn XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in\nliblzma has a bug where invalid input can at least result in a crash\n(CVE-2025-31115). The effects include heap use after free and\nwriting to an address based on the null pointer plus an offset.\nApplications and libraries that use the `lzma_stream_decoder_mt`\nfunction are affected.\n\nThe Haskell *xz-clib* library vendors and builds the C\nimplementation.  The *xz* package does not use the multithreaded\ndecoder and is therefore unaffected.\n","status":"published","published":"2025-11-14T14:45:34Z","modified":"2025-11-14T18:15:45.53003Z","updated_at":"2026-11-02T15:47:17.805107Z"},{"id":"MGASA-2025-0131","title":"Updated xz packages fix security vulnerability","description":"XZ has a heap-use-after-free bug in threaded .xz decoder.\n(CVE-2025-31115)\n","status":"published","published":"2025-04-10T00:22:57Z","modified":"2026-04-16T04:43:00.202453392Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:14984-1","title":"liblzma5-32bit-5.8.1-1.1 on GA media","description":"These are all security issues fixed in the liblzma5-32bit-5.8.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-04-10T00:00:00Z","modified":"2026-02-04T04:22:07.735727Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"SUSE-SU-2025:1137-1","title":"Security update for xz","description":"This update for xz fixes the following issues:\n\n- CVE-2025-31115: Fixed heap use after free and writing to an address based on the null pointer plus an offset (bsc#1240414)\n","status":"published","published":"2025-04-03T15:11:04Z","modified":"2026-02-04T04:37:58.362749Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2025:20553-1","title":"Security update for xz","description":"This update for xz fixes the following issues:\n\n- CVE-2025-31115: Fixed heap use after free and writing to an address based on the null pointer plus an offset  (bsc#1240414)\n","status":"published","published":"2025-08-08T10:14:29Z","modified":"2026-03-23T04:48:58.994639Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"SUSE-SU-2025:20590-1","title":"Security update for xz","description":"This update for xz fixes the following issues:\n\n- CVE-2025-31115: Fixed heap use after free and writing to an address based on the null pointer plus an offset (bsc#1240414)\n","status":"published","published":"2025-08-08T10:26:17Z","modified":"2026-03-23T04:48:20.206741Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"USN-7414-1","title":"xz-utils vulnerability","description":"Harri K. Koskinen discovered that XZ Utils incorrectly handled the threaded\nxz decoder. If a user or automated system were tricked into processing an\nxz file, a remote attacker could use this issue to cause XZ Utils to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n","status":"published","published":"2025-04-03T17:36:53Z","modified":"2026-04-22T10:57:36.479631Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}