XZ Utils 5.8.4

What's new in 5.8.4

IMPORTANT: This includes a fix for a security issue that affects all XZ Utils versions since 5.0.0. This and a few other fixes have also been committed to the old stable branches (v5.2, v5.4, and v5.6) in the xz Git repository. Those fixes are marked below. No new 5.2.x, 5.4.x, or 5.6.x releases will be made.
5.8.4 (2026-09-09)
* liblzma:
- lzma_alone_decoder(), lzma_lzip_decoder(),
lzma_auto_decoder(), and lzma_microlzma_decoder(): Fix an
invalid memory access after memory allocation has failed and
the application reinitializes the existing decoder to decode
a different file. This bug could at least result in a crash.
This is tracked as GHSA-5qpq-xqfv-j9pg. CVE number is pending.
(Also in v5.2, v5.4, and v5.6.)
- lzma_stream_buffer_decode(): Fix wrong error code and,
in debug builds, assertion failure. LZMA_BUF_ERROR could
be returned with truncated inputs while LZMA_DATA_ERROR
is the correct one in this function.
(Also in v5.2, v5.4, and v5.6.)
- Fix a performance issue in the typical use case of
lzma_index_cat(). Internally liblzma calls it from
lzma_file_info_decoder(), so that was affected too. The
problem occurred if the input .xz file was created by
concatenating a large number of .xz files. A crafted file
could make "xz --list" very slow or effectively hang.
Normal decompression doesn't use these functions and
thus wasn't affected.
(Also in v5.2, v5.4, and v5.6.)
- Fix a theoretical integer overflow in lzma_index_cat().
(Also in v5.2, v5.4, and v5.6.)
- Fix bogus memory usage report in lzma_index_decoder() when
the .xz Index is obviously invalid. A huge bogus value could
cause an integer overflow in lzma_file_info_decoder()'s
memory usage reporting due to a missing overflow check,
making lzma_memused() report an incorrect tiny value. This
bug didn't affect the memory usage limiter in these two
decoders; only the reporting via lzma_memused() was affected.
(Also in v5.2, v5.4, and v5.6.)
- Fix a too low memory usage report in lzma_index_decoder()
if lzma_memused() is called after a part of the Index has
already been decoded. The typical use case is to call
lzma_memused() immediately after LZMA_MEMLIMIT_ERROR, …

Full release notes »