Critical Vulnerability in XZ Utils: Heap Use After Free and Null Pointer Dereference
Summary
CVE-2025-31115: XZ Utils provide a general-purpose data-compression library plus command-line tools. Affects xz across 2 version ranges.
< 5.4.3-r1
< d5a2ffe41bb77b918a8c96084885d4dbe4bf6480
Fixed in 5.4.3-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
XZ Utils is a widely-used data-compression library that provides efficient compression and decompression tools. It is particularly known for its multithreaded capabilities, allowing for faster processing of .xz files. However, versions 5.3.3alpha to 5.8.0 contain a significant vulnerability in the multithreaded decoder, which can lead to severe application crashes and security risks.
Vulnerability Detail
The vulnerability arises from a bug in the multithreaded .xz decoder within liblzma, where invalid input can cause heap use after free and writing to an address based on a null pointer plus an offset. This can lead to application crashes and potential exploitation by attackers, making it critical for users of the lzma_stream_decoder_mt function to address this issue promptly.
How To Fix
Minimum fixed version
5.4.3-r1
This is the first release that contains the fix.
sudo apk add --upgrade xzTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the multithreaded decoder function lzma_stream_decoder_mt until they can update to the patched version. This may involve modifying the application code to use the single-threaded decoder instead.
Conclusion
The vulnerability in XZ Utils poses significant risks to applications using the affected versions. It is crucial for users to update to version 5.8.1 or later to mitigate these risks. For those unable to update immediately, a temporary workaround is available.
See every vulnerability recorded for xz →
FAQ
Versions 5.3.3alpha to 5.8.0 of XZ Utils are affected by this vulnerability.
The vulnerability can lead to application crashes, heap corruption, and potential exploitation by malicious actors.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, a standalone patch is available that can be applied to all affected releases, although no new release packages will be made from the old stable branches.
If immediate updating is not possible, avoid using the multithreaded decoder function lzma_stream_decoder_mt as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for xz.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
