CVE-2026-34743
Medium
Description
XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.
SeverityMedium
CVSS5.3
Exploit probability45. percentile0.5%
ProductTukaani Xz
PublishedApr 2, 2026
First seenApr 2, 2026
Weakness typeCWE-122CWE-122
How to fix
Update
- tukaani xz5.8.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tukaani xz | v < 5.8.3 | 5.8.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.