{"id":"USN-8945-1","aliases":[],"status":"published","title":"xz-utils vulnerability","description":"It was discovered that XZ Utils incorrectly handled certain memory\nallocation failures when reinitializing decoders for specific compressed\nfile formats. An attacker could possibly use this issue to trigger an\ninvalid memory write, resulting in a denial of service or arbitrary code\nexecution.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-10-20T17:45:10Z","modified":"2026-10-21T04:30:02Z","fixes":[{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"xz-utils","fixed_in":["5.1.1alpha+20120614-2ubuntu2.14.04.1+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"xz-utils","fixed_in":["5.1.1alpha+20120614-2ubuntu2.16.04.1+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"xz-utils","fixed_in":["5.2.2-1.3ubuntu0.1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"xz-utils","fixed_in":["5.2.4-1ubuntu1.1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"xz-utils","fixed_in":["5.2.5-2ubuntu1.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"xz-utils","fixed_in":["5.6.1+really5.4.5-1ubuntu0.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.10","package":"xz-utils","fixed_in":["5.8.3-1ubuntu1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"xz-utils","fixed_in":["5.8.3-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"xz-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1alpha+20120614-2ubuntu2.14.04.1+esm3"}]}],"versions":["5.1.1alpha+20120614-2ubuntu1","5.1.1alpha+20120614-2ubuntu2","5.1.1alpha+20120614-2ubuntu2.14.04.1+esm1","5.1.1alpha+20120614-2ubuntu2.14.04.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"xz-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1alpha+20120614-2ubuntu2.16.04.1+esm3"}]}],"versions":["5.1.1alpha+20120614-2ubuntu2","5.1.1alpha+20120614-2ubuntu2.16.04.1+esm1","5.1.1alpha+20120614-2ubuntu2.16.04.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"xz-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2-1.3ubuntu0.1+esm2"}]}],"versions":["5.2.2-1.3","5.2.2-1.3ubuntu0.1","5.2.2-1.3ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"xz-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.4-1ubuntu1.1+esm2"}]}],"versions":["5.2.4-1","5.2.4-1ubuntu1","5.2.4-1ubuntu1.1","5.2.4-1ubuntu1.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xz-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-2ubuntu1.2"}]}],"versions":["5.2.5-2","5.2.5-2build1","5.2.5-2build2","5.2.5-2ubuntu1","5.2.5-2ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"xz-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1+really5.4.5-1ubuntu0.4"}]}],"versions":["5.4.1-0.2","5.4.4-0.1","5.4.5-0.1","5.4.5-0.3","5.6.0-0.2","5.6.1+really5.4.5-1","5.6.1+really5.4.5-1build0.1","5.6.1+really5.4.5-1ubuntu0.2","5.6.1+really5.4.5-1ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"xz-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.3-1ubuntu1"}]}],"versions":["5.8.3-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xz-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.3-1ubuntu0.1"}]}],"versions":["5.8.1-1build2","5.8.1-2","5.8.2-1","5.8.2-2","5.8.3-1"]}],"references":[{"url":"https://ubuntu.com/security/notices/USN-8945-1","tags":["advisory"]},{"url":"https://bugs.launchpad.net/bugs/2170056","tags":["report"]}],"sources":{"osv":[{"id":"USN-8945-1","title":"xz-utils vulnerability","description":"It was discovered that XZ Utils incorrectly handled certain memory\nallocation failures when reinitializing decoders for specific compressed\nfile formats. An attacker could possibly use this issue to trigger an\ninvalid memory write, resulting in a denial of service or arbitrary code\nexecution.","status":"published","published":"2026-10-20T17:45:10Z","modified":"2026-10-21T04:30:02.862564501Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}