Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-02 | 1 | Patch1 |
| 2026-04-03 | 1 | Disclosure1 |
CVE-2026-34743: XZ Utils: Buffer overflow https://www.openwall.com/lists/oss-security/2026/03/31/13 can occur in lzma_index_append() under conditions that likely don't exist in any real-world application. Fixed in 5.8.3.
Post summary
The post announces a buffer overflow in XZ Utils and notes it has been fixed in version 5.8.3.
CVE-2026-34743 XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that … https://www.cve.org/CVERecord?id=CVE-2026-34743
Post summary
The text gives a brief disclosure of CVE-2026-34743, pinpointing an issue in XZ Utils involving lzma_index_decoder(), but provides no evidence of exploitation, PoC, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | tukaani | xz | - | - | - |