CVE-2026-34743

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-34743
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34743.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-34743
Aliases
  • GHSA-x872-m794-cxhv
Downstream
ALPINE (1)
AZL (3)
BELL (1)
CLEANSTART (12)
DEBIAN (1)
ECHO (1)
JLSEC (1)
MGASA (1)
OESA (1)
openSUSE (2)
RHSA (2)
RLSA (1)
ROOT (3)
SUSE (7)
UBUNTU (1)
Related
ALSA (1)
openSUSE (2)
SUSE (7)
Published
2026-04-02T18:36:37Z
Modified
2026-09-09T12:26:38Z
Severity
  • 1.7 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U CVSS Calculator
Summary
XZ Utils: Buffer overflow in lzma_index_append()
Details

XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-122"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34743.json"
}
References

Affected packages

Git / github.com/tukaani-project/xz

Affected ranges

Type
GIT
Repo
https://github.com/tukaani-project/xz
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4b73f2ec19a99ef465282fbce633e8deb33691b3
Fixed
c8c22869e780ff57c96b46939c3d79ff99395f87
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:tukaani:xz:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "5.8.3"
        }
    ],
    "source":  [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

v4.*
v4.42.2alpha
v4.999.3alpha
v4.999.5alpha
v4.999.7beta
v4.999.8beta
v4.999.9beta
v5.*
v5.0.0
v5.1.0alpha
v5.1.1alpha
v5.1.2alpha
v5.1.3alpha
v5.1.4beta
v5.2.0
v5.2.1
v5.3.1alpha
v5.3.2alpha
v5.3.3alpha
v5.3.4alpha
v5.3.5beta
v5.4.0
v5.5.0alpha
v5.5.1alpha
v5.5.2beta
v5.7.0alpha
v5.7.1alpha
v5.7.2beta
v5.8.0
v5.8.1
v5.8.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34743.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "50025824752531838876270586168577736298",
            "length":  1799
        },
        "id":  "CVE-2026-34743-8bf2b829",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/tukaani-project/xz/commit/c8c22869e780ff57c96b46939c3d79ff99395f87",
        "target":  {
            "file":  "src/liblzma/common/index.c",
            "function":  "lzma_index_append"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "189021365865857008318232289039297103124",
                "314911882038425734515188493524891833443",
                "211617179559452375355043576420664790012",
                "26911717901058952735636282764262730641",
                "172566969959909635515254092570109171954",
                "309215456910578642829530044367921726652"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-34743-9c1f8a10",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/tukaani-project/xz/commit/c8c22869e780ff57c96b46939c3d79ff99395f87",
        "target":  {
            "file":  "src/liblzma/common/index.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "328129197884697836206461655903934437677",
            "length":  152
        },
        "id":  "CVE-2026-34743-aa610b77",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/tukaani-project/xz/commit/c8c22869e780ff57c96b46939c3d79ff99395f87",
        "target":  {
            "file":  "src/liblzma/common/index.c",
            "function":  "lzma_index_prealloc"
        }
    }
]
vanir_signatures_modified 
"2026-08-12T15:33:38Z"