CVE-2025-31115

XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects include heap use after free and writing to an address based on the null pointer plus an offset. Applications and libraries that use the lzma_stream_decoder_mt function are affected. The bug has been fixed in XZ Utils 5.8.1, and the fix has been committed to the v5.4, v5.6, v5.8, and master branches in the xz Git repository. No new release packages will be made from the old stable branches, but a standalone patch is available that applies to all affected releases.

• CWE-366
• CWE-416
• CWE-476
• CWE-826

• https://github.com/tukaani-project/xz/commit/d5a2ffe41bb77b918a8c96084885d4dbe4bf6480
• https://github.com/tukaani-project/xz/security/advisories/GHSA-6cc8-p5mm-29w2
• https://tukaani.org/xz/xz-cve-2025-31115.patch
• http://www.openwall.com/lists/oss-security/2025/04/03/1
• http://www.openwall.com/lists/oss-security/2025/04/03/2
• http://www.openwall.com/lists/oss-security/2025/04/03/3
• https://cert-portal.siemens.com/productcert/html/ssa-082556.html

Published

Apr 3, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-3111An issue has been discovered in GitLab CE/EE affecting all v…6.5
• CVE-2025-31110Rejected reason: Not used
• CVE-2025-31111Rejected reason: Not used
• CVE-2025-31112Rejected reason: Not used
• CVE-2025-31113Rejected reason: Not used
• CVE-2025-31114Fooocus is an image generating software. In versions 2.5.5 a…9.3
• CVE-2025-31116Mobile Security Framework (MobSF) is a pen-testing, malware …9.8
• CVE-2025-31117OpenEMR is a free and open source electronic health records …7.5
• CVE-2025-31118NamelessMC is a free, easy to use & powerful website softwar…7.1
• CVE-2025-31119generator-jhipster-entity-audit is a JHipster module to enab…7.6
• CVE-2025-3112CWE-400: Uncontrolled Resource Consumption vulnerability exi…7.1
• CVE-2025-31120NamelessMC is a free, easy to use & powerful website softwar…5.3