MNBSD-2026-20: heap buffer overflow in liblzma lzma_index_append() via an empty Index

Description

XZ Utils provide a general-purpose data-compression library (liblzma) plus command-line tools. If lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where a subsequent lzma_index_append() would allocate too little memory, causing a heap-based buffer overflow (CWE-122). Affects xz/liblzma before 5.8.3.

Affected Versions

xz

Recommendations

No specific recommendations provided.

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-34743
• https://github.com/tukaani-project/xz/security/advisories/GHSA-x872-m794-cxhv
• https://github.com/tukaani-project/xz/releases/tag/v5.8.3
• https://github.com/tukaani-project/xz/commit/c8c22869e780ff57c96b46939c3d79ff99395f87
• http://www.openwall.com/lists/oss-security/2026/03/31/13

Additional Information

Aliases: CVE-2026-34743

Published: June 11, 2026
Last Modified: June 11, 2026