Critical Vulnerability in XZ Utils: Multithreaded Decoder Crash Risk
Summary
DEBIAN-CVE-2025-31115: XZ Utils provide a general-purpose data-compression library plus command-line tools. Affects xz-utils versions < 5.4.1-1. Fixed in 5.4.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
XZ Utils is a widely used data-compression library that provides both a library and command-line tools for handling .xz files. It is known for its high compression ratio and is utilized in various applications and libraries for efficient data storage and transmission. However, a recent vulnerability has been identified in the multithreaded .xz decoder, which can lead to severe application crashes and potential exploitation.
Vulnerability Detail
The vulnerability exists in XZ Utils versions 5.3.3alpha to 5.8.0, specifically within the multithreaded .xz decoder in the liblzma library. A bug allows for invalid input to cause a crash, leading to heap use after free and writing to an address based on a null pointer plus an offset. This can result in unexpected behavior, including application crashes and potential security risks for applications relying on the lzma_stream_decoder_mt function.
How To Fix
Minimum fixed version
5.4.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade xz-utilsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the multithreaded .xz decoder until the package is updated to a secure version. Additionally, validate input data before processing it with the decoder to minimize the risk of crashes.
Conclusion
The identified vulnerability in XZ Utils poses significant risks to applications utilizing the multithreaded .xz decoder. It is crucial to update to the patched versions to mitigate these risks and ensure application stability. Regular monitoring with tools like Vulert can help maintain awareness of vulnerabilities in your software.
See every vulnerability recorded for xz-utils →
FAQ
XZ Utils versions from 5.3.3alpha to 5.8.0 are affected by this vulnerability.
The vulnerability can lead to application crashes and may allow for exploitation through heap use after free.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Yes, the vulnerability has been fixed in XZ Utils version 5.8.1 and in version 5.4.1-1 for Debian 12.
As a temporary measure, avoid using the multithreaded .xz decoder and validate input data before processing.
References
Related vulnerabilities
Recent vulnerabilities recorded for xz-utils.
