https://seclists.org/oss-sec/2026/q3/693: Fwd: XZ Utils 5.8.4 and a security fix

Q: What conditions are required to trigger the invalid memory write?

Memory allocation must first fail while using one of the affected decoder interfaces, and the application must then reinitialize that existing decoder to decode a different file. The affected interfaces are lzma_alone_decoder(), lzma_lzip_decoder(), lzma_auto_decoder(), and lzma_microlzma_decoder().

Q: What is the known impact?

The issue could at least cause an application crash. The provided information does not describe any further demonstrated impact.

Q: What should users of the older stable branches do if they cannot move to 5.8.4?

The fixes were committed to the v5.2, v5.4, and v5.6 branches in the xz Git repository. No new 5.2.x, 5.4.x, or 5.6.x releases are planned, so users of those branches would need to obtain the committed fixes rather than wait for a maintenance release.

Q: How can an application determine whether it is exposed to this condition?

Review whether it uses an affected decoder interface and can reuse an existing decoder after an allocation failure to process a different file. Versions 5.8.3 and older are affected according to the release announcement.

Published Sep 9, 2026

Updated

Affected Software

1 affected component

Tukaani XZ Utils>5.8.4<=5.8.3

Frequently Asked Questions

What conditions are required to trigger the invalid memory write?

Memory allocation must first fail while using one of the affected decoder interfaces, and the application must then reinitialize that existing decoder to decode a different file. The affected interfaces are lzma_alone_decoder(), lzma_lzip_decoder(), lzma_auto_decoder(), and lzma_microlzma_decoder().

What is the known impact?

The issue could at least cause an application crash. The provided information does not describe any further demonstrated impact.

What should users of the older stable branches do if they cannot move to 5.8.4?

The fixes were committed to the v5.2, v5.4, and v5.6 branches in the xz Git repository. No new 5.2.x, 5.4.x, or 5.6.x releases are planned, so users of those branches would need to obtain the committed fixes rather than wait for a maintenance release.

How can an application determine whether it is exposed to this condition?

Review whether it uses an affected decoder interface and can reuse an existing decoder after an allocation failure to process a different file. Versions 5.8.3 and older are affected according to the release announcement.