CVE-2026-34743
- Source
- https://cve.org/CVERecord?id=CVE-2026-34743
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34743.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-34743
- Aliases
-
- GHSA-x872-m794-cxhv
- Downstream
- Related
- Published
- 2026-04-02T18:36:37.450Z
- Modified
- 2026-07-23T08:25:11.790413Z
- Severity
-
- 1.7 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U CVSS Calculator
- Summary
- XZ Utils: Buffer overflow in lzma_index_append()
- Details
-
XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzmaindexdecoder() was used to decode an Index that contained no Records, the resulting lzmaindex was left in a state where where a subsequent lzmaindex_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.
- Database specific
{ "cwe_ids": [ "CWE-122" ], "cna_assigner": "GitHub_M", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34743.json" }- References
-
- http://www.openwall.com/lists/oss-security/2026/03/31/13
- https://github.com/tukaani-project/xz/releases/tag/v5.8.3
- https://lists.debian.org/debian-lts-announce/2026/07/msg00034.html
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34743.json
- https://github.com/tukaani-project/xz/security/advisories/GHSA-x872-m794-cxhv
- https://nvd.nist.gov/vuln/detail/CVE-2026-34743
- https://github.com/tukaani-project/xz/commit/c8c22869e780ff57c96b46939c3d79ff99395f87
Affected packages
Git / github.com/tukaani-project/xz
Affected ranges
- Type
- GIT
- Repo
- https://github.com/tukaani-project/xz
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixed
- Database specific
{ "cpe": "cpe:2.3:a:tukaani:xz:*:*:*:*:*:*:*:*", "extracted_events": [ { "introduced": "0" }, { "fixed": "5.8.3" } ], "source": [ "CPE_RANGE", "REFERENCES" ] }
Affected versions
v4.*
v4.42.2alpha
v4.999.3alpha
v4.999.5alpha
v4.999.7beta
v4.999.8beta
v4.999.9beta
v5.*
v5.0.0
v5.1.0alpha
v5.1.1alpha
v5.1.2alpha
v5.1.3alpha
v5.1.4beta
v5.2.0
v5.2.1
v5.3.1alpha
v5.3.2alpha
v5.3.3alpha
v5.3.4alpha
v5.3.5beta
v5.4.0
v5.5.0alpha
v5.5.1alpha
v5.5.2beta
v5.7.0alpha
v5.7.1alpha
v5.7.2beta
v5.8.0
v5.8.1
v5.8.2
Database specific
vanir_signatures_modified
"2026-07-23T08:25:11Z"
vanir_signatures
[
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 1799.0,
"function_hash": "50025824752531838876270586168577736298"
},
"signature_version": "v1",
"source": "https://github.com/tukaani-project/xz/commit/c8c22869e780ff57c96b46939c3d79ff99395f87",
"id": "CVE-2026-34743-8bf2b829",
"target": {
"function": "lzma_index_append",
"file": "src/liblzma/common/index.c"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"189021365865857008318232289039297103124",
"314911882038425734515188493524891833443",
"211617179559452375355043576420664790012",
"26911717901058952735636282764262730641",
"172566969959909635515254092570109171954",
"309215456910578642829530044367921726652"
]
},
"signature_version": "v1",
"source": "https://github.com/tukaani-project/xz/commit/c8c22869e780ff57c96b46939c3d79ff99395f87",
"id": "CVE-2026-34743-9c1f8a10",
"target": {
"file": "src/liblzma/common/index.c"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 152.0,
"function_hash": "328129197884697836206461655903934437677"
},
"signature_version": "v1",
"source": "https://github.com/tukaani-project/xz/commit/c8c22869e780ff57c96b46939c3d79ff99395f87",
"id": "CVE-2026-34743-aa610b77",
"target": {
"function": "lzma_index_prealloc",
"file": "src/liblzma/common/index.c"
}
}
]
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34743.json"