CVE-2025-31115 XZ has a heap-use-after-free bug in threaded .xz decoder
A heap use-after-free bug in the XZ Utils multithreaded decoder allows attackers to cause a crash via invalid input.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-31115?
CVE-2025-31115 is a high-severity use after free vulnerability in tukaani-project xz, published on 3 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects include heap use after free and writing to an address based on the null pointer plus an offset. Applications and libraries that use the lzma_stream_decoder_mt function are affected. The bug has been fixed in XZ Utils 5.8.1, and the fix has been committed to the v5.4, v5.6, v5.8, and master branches in the xz Git repository. No new release packages will be made from the old stable branches, but a standalone patch is available that applies to all affected releases.
Which versions are affected by CVE-2025-31115?
1 open source package ship an affected version, including xz-clib.
| Package | Affected | Fixed in |
|---|---|---|
xz-clib Hackage | From 5.6.3 | 5.8.1 |
Linux distribution packages (18)
xz AlmaLinux:10 | All versions | 1:5.6.2-4.el10_0 |
xz-devel AlmaLinux:10 | All versions | 1:5.6.2-4.el10_0 |
xz-libs AlmaLinux:10 | All versions | 1:5.6.2-4.el10_0 |
xz-lzma-compat AlmaLinux:10 | All versions | 1:5.6.2-4.el10_0 |
xz Red Hat:enterprise_linux:10.0 | All versions | 1:5.6.2-4.el10_0 |
xz-debuginfo Red Hat:enterprise_linux:10.0 | All versions | 1:5.6.2-4.el10_0 |
xz-debugsource Red Hat:enterprise_linux:10.0 | All versions | 1:5.6.2-4.el10_0 |
xz-devel Red Hat:enterprise_linux:10.0 | All versions | 1:5.6.2-4.el10_0 |
xz-libs Red Hat:enterprise_linux:10.0 | All versions | 1:5.6.2-4.el10_0 |
xz-libs-debuginfo Red Hat:enterprise_linux:10.0 | All versions | 1:5.6.2-4.el10_0 |
xz-lzma-compat Red Hat:enterprise_linux:10.0 | All versions | 1:5.6.2-4.el10_0 |
xz-lzma-compat-debuginfo Red Hat:enterprise_linux:10.0 | All versions | 1:5.6.2-4.el10_0 |
xz Rocky Linux:10 | All versions | 1:5.6.2-4.el10_0 |
xz SUSE:Linux Enterprise Module for Basesystem 15 SP6 | All versions | 5.4.1-150600.3.3.1 |
xz SUSE:Linux Micro 6.0 | All versions | 5.4.3-5.1 |
xz SUSE:Linux Micro 6.1 | All versions | 5.4.3-slfo.1.1_2.1 |
xz openSUSE:Leap 15.6 | All versions | 5.4.1-150600.3.3.1 |
xz openSUSE:Tumbleweed | All versions | 5.8.1-1.1 |
How do I fix CVE-2025-31115?
Upgrade xz-clib to 5.8.1 or later.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2025-31115 being exploited?
There is no known exploitation of CVE-2025-31115 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2025-31115, ALSA-2025:7524, AZL-59497, BELL-CVE-2025-31115, DEBIAN-CVE-2025-31115, DSA-5895-1 and 14 more.