CVE-2025-31115 XZ has a heap-use-after-free bug in threaded .xz decoder

🗓️ 03 Apr 2025 16:57:05Reported by GoogleType

osv

osv🔗 osv.dev👁 14 Views

Bug in XZ Utils multithreaded decoder leads to crash; fixed in version 5.8.1 with patch available.

Reporter	Title	Published	Views	Family All 82
IBM Security Bulletins	Security Bulletin: A denial-of-service attack, heap use after free, network server exploit, and other vulnerabilities might affect IBM Storage Defender - Resiliency Service	8 Jul 202517:32	–	ibm
FreeBSD	FreeBSD -- Use-after-free in multi-threaded xz decoder	2 Jul 202500:00	–	freebsd
AlpineLinux	CVE-2025-31115	3 Apr 202516:57	–	alpinelinux
AstraLinux	Astra Linux - уязвимость в xz-utils	16 Jun 202511:28	–	astralinux
Tenable Nessus	Azure Linux 3.0 Security Update: xz (CVE-2025-31115)	22 Jan 202600:00	–	nessus
Tenable Nessus	Debian dsa-5895 : liblzma-dev - security update	15 May 202500:00	–	nessus
Tenable Nessus	Fedora 41 : perl-Compress-Raw-Lzma / xz (2025-051becf4f2)	10 May 202500:00	–	nessus
Tenable Nessus	Fedora 40 : perl-Compress-Raw-Lzma / xz (2025-4871b31998)	10 May 202500:00	–	nessus
Tenable Nessus	FreeBSD : FreeBSD -- Use-after-free in multi-threaded xz decoder (7642ba72-5abf-11f0-87ba-002590c1f29c)	7 Jul 202500:00	–	nessus
Tenable Nessus	GLSA-202504-01 : XZ Utils: Use after free	5 Apr 202500:00	–	nessus

Source	Link
openwall	www.openwall.com/lists/oss-security/2025/04/03/1
openwall	www.openwall.com/lists/oss-security/2025/04/03/2
openwall	www.openwall.com/lists/oss-security/2025/04/03/3
tukaani	www.tukaani.org/xz/xz-cve-2025-31115.patch
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31115.json
github	www.github.com/tukaani-project/xz/security/advisories/GHSA-6cc8-p5mm-29w2
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-31115
github	www.github.com/tukaani-project/xz/commit/d5a2ffe41bb77b918a8c96084885d4dbe4bf6480

16 Apr 2026 04:38Current

7.6High risk

Vulners AI Score7.6

CVSS 48.7

EPSS0.00041

xz utils data compression multithreaded decoder security bug heap use after free standalone patch.