CVE-2025-31115: XZ has a heap-use-after-free bug in threaded .xz decoder
Last updated 9 April 2025
Other sources
XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects include heap use after free and writing to an address based on the null pointer plus an offset. Applications and libraries that use the lzmastreamdecodermt function are affected. The bug has been fixed in XZ Utils 5.8.1, and the fix has been committed to the v5.4, v5.6, v5.8, and master branches in the xz Git repository. No new release packages will be made from the old stable branches, but a standalone patch is available that applies to all affected releases.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/xz-utilsto a version that resolves this vulnerability.Fixed in 5.2.5-2.1~deb11u1Fixed in 5.4.1-1Fixed in 5.8.1-1 - Upgrade
Upgrade
XZ Utils (liblzma threaded .xz decoder)to a version that resolves this vulnerability.Fixed in 5.8.1Patch CVE-2025-31115 - Compensating control
If upgrading to XZ Utils 5.8.1 (or applying the standalone patch) is not immediately possible, avoid processing untrusted .xz data with applications/libraries that use the lzma_stream_decoder_mt function, since invalid input can trigger a crash and lead to heap use-after-free (CVE-2025-31115).
- Operational
After upgrading to XZ Utils 5.8.1 (or the standalone patch), restart any services/tools that may have been processing untrusted .xz inputs to clear any possible effects of the crash/exploitation of CVE-2025-31115 (heap-use-after-free / null-pointer based write).
Event History
Frequently Asked Questions
What is the severity of CVE-2025-31115?
CVE-2025-31115 has a medium severity rating due to potential crashes from invalid input.
How do I fix CVE-2025-31115?
To fix CVE-2025-31115, update XZ Utils to a version later than 5.8.0.
What types of software are affected by CVE-2025-31115?
CVE-2025-31115 affects the XZ Utils library versions from 5.3.3alpha to 5.8.0.
What vulnerabilities are associated with CVE-2025-31115?
CVE-2025-31115 can lead to heap use after free vulnerabilities and may result in application crashes.
Is CVE-2025-31115 a remote code execution vulnerability?
No, CVE-2025-31115 is not classified as a remote code execution vulnerability.