CVE-2026-34743: XZ Utils Buffer Overflow Vulnerability

CVE-2026-34743 Overview

A heap-based buffer overflow vulnerability has been identified in XZ Utils, the widely-used general-purpose data-compression library. The vulnerability exists in the lzma_index_decoder() function when decoding an Index that contains no Records. When this condition occurs, the resulting lzma_index structure is left in an invalid state where a subsequent call to lzma_index_append() allocates insufficient memory, leading to a heap buffer overflow.

Critical Impact

Applications using XZ Utils that decode empty Index structures and subsequently append Records may be vulnerable to heap buffer overflow, potentially leading to denial of service or memory corruption.

Affected Products

• XZ Utils versions prior to 5.8.3
• liblzma library versions prior to 5.8.3
• Applications and systems utilizing vulnerable XZ Utils/liblzma versions

Discovery Timeline

• 2026-04-02 - CVE CVE-2026-34743 published to NVD
• 2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-34743

Vulnerability Analysis

This vulnerability is classified as CWE-122: Heap-based Buffer Overflow. The issue occurs due to improper memory allocation when the lzma_index_decoder() function processes an Index with zero Records. Under normal operation, the first call to lzma_index_append() would reset the i->prealloc value to INDEX_GROUP_SIZE. However, when decoding an empty Index, lzma_index_append() is never called during the decoding process, meaning the prealloc value is never reset from zero.

The lzma_index_append() function assumes that i->prealloc is always greater than zero. When an application subsequently calls lzma_index_append() after decoding an empty Index, the function allocates a buffer based on the incorrect prealloc value of zero, resulting in insufficient memory allocation and a subsequent heap buffer overflow when data is written.

While appending Records after decoding an Index is described as a rare operation, it is a valid and supported use case that should function correctly.

Root Cause

The root cause is a missing boundary check in the preallocation logic within src/liblzma/common/index.c. When lzma_index_decoder() is called with records == 0, the code failed to set a safe default value for i->prealloc, leaving it at zero. This violates the assumption in lzma_index_append() that i->prealloc is always positive, leading to undersized buffer allocation.

Attack Vector

The vulnerability is network-accessible with low attack complexity. An attacker could potentially craft a malicious XZ-compressed file containing an empty Index structure. When a vulnerable application processes this file and subsequently calls lzma_index_append(), the heap buffer overflow is triggered. The impact is primarily limited to availability (denial of service), though memory corruption could theoretically lead to more severe consequences depending on the application context.

 	if (records > PREALLOC_MAX)
 		records = PREALLOC_MAX;
 
+	// If index_decoder.c calls us with records == 0, it's decoding
+	// an Index that has no Records. In that case the decoder won't call
+	// lzma_index_append() at all, and i->prealloc isn't used during
+	// the Index decoding either.
+	//
+	// Normally the first lzma_index_append() call from the Index decoder
+	// would reset i->prealloc to INDEX_GROUP_SIZE. With no Records,
+	// lzma_index_append() isn't called and the resetting of prealloc
+	// won't occur either. Thus, if records == 0, use the default value
+	// INDEX_GROUP_SIZE instead.
+	//
+	// NOTE: lzma_index_append() assumes i->prealloc > 0. liblzma <= 5.8.2
+	// didn't have this check and could set i->prealloc = 0, which would
+	// result in a buffer overflow if the application called
+	// lzma_index_append() after decoding an empty Index. Appending
+	// Records after decoding an Index is a rare thing to do, but
+	// it is supposed to work.
+	if (records == 0)
+		records = INDEX_GROUP_SIZE;
+
 	i->prealloc = (size_t)(records);
 	return;
}

Source: GitHub Commit Update

Detection Methods for CVE-2026-34743

Indicators of Compromise

• Unexpected application crashes or segmentation faults when processing XZ-compressed files
• Memory corruption errors in applications using liblzma for decompression operations
• Abnormal heap allocation patterns in processes utilizing XZ Utils

Detection Strategies

• Monitor for crashes in applications using lzma_index_decoder() and lzma_index_append() function calls
• Implement version checking to identify systems running XZ Utils versions prior to 5.8.3
• Deploy memory corruption detection tools (AddressSanitizer, Valgrind) in development and staging environments

Monitoring Recommendations

• Track XZ Utils package versions across all managed systems using software inventory tools
• Monitor system logs for heap corruption or buffer overflow indicators from applications using liblzma
• Enable core dump collection for affected applications to support forensic analysis

How to Mitigate CVE-2026-34743

Immediate Actions Required

• Upgrade XZ Utils to version 5.8.3 or later immediately
• Review applications that use lzma_index_decoder() followed by lzma_index_append() for potential exposure
• Consider restricting processing of untrusted XZ-compressed files until patching is complete

Patch Information

The vulnerability has been patched in XZ Utils version 5.8.3. The fix adds a boundary check to ensure that when records == 0 is passed to the preallocation function, the default value INDEX_GROUP_SIZE is used instead of zero. This ensures that i->prealloc is always positive, maintaining the invariant expected by lzma_index_append().

Patch details are available via the GitHub Security Advisory GHSA-x872-m794-cxhv and the GitHub Release v5.8.3.

Workarounds

• Avoid calling lzma_index_append() after decoding an Index structure if upgrading is not immediately possible
• Implement input validation to reject XZ files with empty Index structures before processing
• Use application sandboxing to limit the impact of potential memory corruption

# Check current XZ Utils version
xz --version

# Update XZ Utils on Debian/Ubuntu systems
sudo apt update && sudo apt install xz-utils

# Update XZ Utils on RHEL/CentOS systems
sudo yum update xz

# Verify installed version after update
xz --version | grep -E "^xz \(XZ Utils\)"