# CVE-2026-34743: XZ Utils: Buffer overflow in lzma_index_append()

CVE-2026-34743 is fixed in 7 products on 1 platform, first by liblzma5 5.2.2-1.3ubuntu0.1+esm1, released April 2, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-34743
- Priority: Routine
- CVSS: 5.3 (Low)
- EPSS: 0.0053
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Apr 2, 2026
- Weakness: Heap-based Buffer Overflow
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34743

## Description

XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | liblzma5 Ubuntu 18.04.6 LTS (bionic) | 5.2.2-1.3ubuntu0.1+esm1 | [liblzma5 5.2.2-1.3ubuntu0.1+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-liblzma5-5.2.2-1.3ubuntu0.1-esm1.md) | Apr 2, 2026 |
| Linux | liblzma5 Ubuntu 20.04 LTS (focal) | 5.2.4-1ubuntu1.1+esm1 | [liblzma5 5.2.4-1ubuntu1.1+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-liblzma5-5.2.4-1ubuntu1.1-esm1.md) | Apr 2, 2026 |
| Linux | liblzma5 Ubuntu 22.04.1 LTS (jammy) | 5.2.5-2ubuntu1.1 | [liblzma5 5.2.5-2ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-liblzma5-5.2.5-2ubuntu1.1.md) | Apr 2, 2026 |
| Linux | liblzma5 Ubuntu 24.04.5 LTS (noble) | 5.6.1+really5.4.5-1ubuntu0.3 | [liblzma5 5.6.1+really5.4.5-1ubuntu0.3](https://patchblox.com/security/data/fix/linux/ubuntu-noble-liblzma5-5.6.1-really5.4.5-1ubuntu0.3.md) | Apr 2, 2026 |
| Linux | liblzma5 Ubuntu 25.10 (questing) | 5.8.1-1ubuntu0.1 | [liblzma5 5.8.1-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-questing-liblzma5-5.8.1-1ubuntu0.1.md) | Apr 2, 2026 |
| Linux | xz RHEL 10 | 5.6.2-4.el10_2.1 | [RHSA-2026:64787](https://patchblox.com/security/data/fix/linux/rhsa-2026-64787.md) | Apr 2, 2026 |
| Linux | xz RHEL 9 | 0:5.2.5-8.el9_8.1 | [RHSA-2026:89749](https://patchblox.com/security/data/fix/linux/rhsa-2026-89749.md) | Oct 27, 2026 |
| Linux | xz almalinux 10 | 1:5.6.2-4.el10_2.1 | [ALSA-2026:64787](https://patchblox.com/security/data/fix/linux/alsa-2026-64787.md) | Sep 8, 2026 |
| Linux | xz almalinux 9 | 5.2.5-8.el9_8.1 | [ALSA-2026:89749](https://patchblox.com/security/data/fix/linux/alsa-2026-89749.md) | Nov 7, 2026 |
| Linux | xz ol 10 | 1:5.6.2-4.el10_2.1 | [ELSA-2026-64787-0](https://patchblox.com/security/data/fix/linux/elsa-2026-64787-0.md) | Sep 8, 2026 |
| Linux | xz ol 9 | 0:5.2.5-8.el9_8.1 | [ELSA-2026-89749](https://patchblox.com/security/data/fix/linux/elsa-2026-89749.md) | Nov 7, 2026 |
| Linux | xz rocky 10 | 1:5.6.2-4.el10_2.1 | [RLSA-2026:64787](https://patchblox.com/security/data/fix/linux/rlsa-2026-64787.md) | Sep 9, 2026 |
| Linux | xz rocky 9 | 0:5.2.5-8.el9_8.1 | [RLSA-2026:89749](https://patchblox.com/security/data/fix/linux/rlsa-2026-89749.md) | Nov 7, 2026 |
| Linux | xz-devel RHEL 9 | 0:5.2.5-8.el9_8.1 | [RHSA-2026:89749](https://patchblox.com/security/data/fix/linux/rhsa-2026-89749.md) | Oct 27, 2026 |
| Linux | xz-devel almalinux 10 | 1:5.6.2-4.el10_2.1 | [ALSA-2026:64787](https://patchblox.com/security/data/fix/linux/alsa-2026-64787.md) | Sep 8, 2026 |
| Linux | xz-devel almalinux 9 | 5.2.5-8.el9_8.1 | [ALSA-2026:89749](https://patchblox.com/security/data/fix/linux/alsa-2026-89749.md) | Nov 7, 2026 |
| Linux | xz-devel ol 10 | 1:5.6.2-4.el10_2.1 | [ELSA-2026-64787-0](https://patchblox.com/security/data/fix/linux/elsa-2026-64787-0.md) | Sep 8, 2026 |
| Linux | xz-devel ol 9 | 0:5.2.5-8.el9_8.1 | [ELSA-2026-89749](https://patchblox.com/security/data/fix/linux/elsa-2026-89749.md) | Nov 7, 2026 |
| Linux | xz-libs RHEL 9 | 0:5.2.5-8.el9_8.1 | [RHSA-2026:89749](https://patchblox.com/security/data/fix/linux/rhsa-2026-89749.md) | Oct 27, 2026 |
| Linux | xz-libs almalinux 10 | 1:5.6.2-4.el10_2.1 | [ALSA-2026:64787](https://patchblox.com/security/data/fix/linux/alsa-2026-64787.md) | Sep 8, 2026 |
| Linux | xz-libs almalinux 9 | 5.2.5-8.el9_8.1 | [ALSA-2026:89749](https://patchblox.com/security/data/fix/linux/alsa-2026-89749.md) | Nov 7, 2026 |
| Linux | xz-libs ol 10 | 1:5.6.2-4.el10_2.1 | [ELSA-2026-64787-0](https://patchblox.com/security/data/fix/linux/elsa-2026-64787-0.md) | Sep 8, 2026 |
| Linux | xz-libs ol 9 | 0:5.2.5-8.el9_8.1 | [ELSA-2026-89749](https://patchblox.com/security/data/fix/linux/elsa-2026-89749.md) | Nov 7, 2026 |
| Linux | xz-lzma-compat RHEL 9 | 0:5.2.5-8.el9_8.1 | [RHSA-2026:89749](https://patchblox.com/security/data/fix/linux/rhsa-2026-89749.md) | Oct 27, 2026 |
| Linux | xz-lzma-compat almalinux 10 | 1:5.6.2-4.el10_2.1 | [ALSA-2026:64787](https://patchblox.com/security/data/fix/linux/alsa-2026-64787.md) | Sep 8, 2026 |
| Linux | xz-lzma-compat almalinux 9 | 5.2.5-8.el9_8.1 | [ALSA-2026:89749](https://patchblox.com/security/data/fix/linux/alsa-2026-89749.md) | Nov 7, 2026 |
| Linux | xz-lzma-compat ol 10 | 1:5.6.2-4.el10_2.1 | [ELSA-2026-64787-0](https://patchblox.com/security/data/fix/linux/elsa-2026-64787-0.md) | Sep 8, 2026 |
| Linux | xz-lzma-compat ol 9 | 0:5.2.5-8.el9_8.1 | [ELSA-2026-89749](https://patchblox.com/security/data/fix/linux/elsa-2026-89749.md) | Nov 7, 2026 |
| Linux | xz-utils Debian 12.15 (bookworm) | 5.4.1-1+deb12u1 | [DEBIAN-CVE-2026-34743](https://patchblox.com/security/data/fix/linux/debian-cve-2026-34743.md) | Apr 2, 2026 |
| Linux | xz-utils Debian 13.5 (trixie) | 5.8.1-1+deb13u1 | [DEBIAN-CVE-2026-34743](https://patchblox.com/security/data/fix/linux/debian-cve-2026-34743.md) | Apr 2, 2026 |
| Linux | xz-utils Debian 14 | 5.8.3-1 | [DEBIAN-CVE-2026-34743](https://patchblox.com/security/data/fix/linux/debian-cve-2026-34743.md) | Apr 2, 2026 |
| Linux | xz-utils Ubuntu 18.04.6 LTS (bionic) | 5.2.2-1.3ubuntu0.1+esm1 | [xz-utils 5.2.2-1.3ubuntu0.1+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-xz-utils-5.2.2-1.3ubuntu0.1-esm1.md) | Apr 2, 2026 |
| Linux | xz-utils Ubuntu 20.04 LTS (focal) | 5.2.4-1ubuntu1.1+esm1 | [xz-utils 5.2.4-1ubuntu1.1+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-xz-utils-5.2.4-1ubuntu1.1-esm1.md) | Apr 2, 2026 |
| Linux | xz-utils Ubuntu 22.04.1 LTS (jammy) | 5.2.5-2ubuntu1.1 | [xz-utils 5.2.5-2ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-xz-utils-5.2.5-2ubuntu1.1.md) | Apr 2, 2026 |
| Linux | xz-utils Ubuntu 24.04.5 LTS (noble) | 5.6.1+really5.4.5-1ubuntu0.3 | [xz-utils 5.6.1+really5.4.5-1ubuntu0.3](https://patchblox.com/security/data/fix/linux/ubuntu-noble-xz-utils-5.6.1-really5.4.5-1ubuntu0.3.md) | Apr 2, 2026 |
| Linux | xz-utils Ubuntu 25.10 (questing) | 5.8.1-1ubuntu0.1 | [xz-utils 5.8.1-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-questing-xz-utils-5.8.1-1ubuntu0.1.md) | Apr 2, 2026 |
| Linux | xzdec Ubuntu 18.04.6 LTS (bionic) | 5.2.2-1.3ubuntu0.1+esm1 | [xzdec 5.2.2-1.3ubuntu0.1+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-xzdec-5.2.2-1.3ubuntu0.1-esm1.md) | Apr 2, 2026 |
| Linux | xzdec Ubuntu 20.04 LTS (focal) | 5.2.4-1ubuntu1.1+esm1 | [xzdec 5.2.4-1ubuntu1.1+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-xzdec-5.2.4-1ubuntu1.1-esm1.md) | Apr 2, 2026 |
| Linux | xzdec Ubuntu 22.04.1 LTS (jammy) | 5.2.5-2ubuntu1.1 | [xzdec 5.2.5-2ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-xzdec-5.2.5-2ubuntu1.1.md) | Apr 2, 2026 |
| Linux | xzdec Ubuntu 24.04.5 LTS (noble) | 5.6.1+really5.4.5-1ubuntu0.3 | [xzdec 5.6.1+really5.4.5-1ubuntu0.3](https://patchblox.com/security/data/fix/linux/ubuntu-noble-xzdec-5.6.1-really5.4.5-1ubuntu0.3.md) | Apr 2, 2026 |
| Linux | xzdec Ubuntu 25.10 (questing) | 5.8.1-1ubuntu0.1 | [xzdec 5.8.1-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-questing-xzdec-5.8.1-1ubuntu0.1.md) | Apr 2, 2026 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.