HSEC-2025-0003
NoneCVSS
—
EPSS
—
Published
Nov 14, 2025
CISA due date
—
The record
Use after free in multithreaded lzma (.xz) decoder
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Alpine:v3.18 | xz | 0 | 5.4.3-r1 |
| Alpine:v3.19 | xz | 0 | 5.4.5-r1 |
| Alpine:v3.20 | xz | 0 | 5.6.2-r1 |
| Alpine:v3.21 | xz | 0 | 5.6.3-r1 |
| Alpine:v3.22 | xz | 0 | 5.8.1-r0 |
| Debian:12 | xz-utils | 0 | 5.4.1-1 |
| Debian:13 | xz-utils | 0 | No fix |
| Hackage | xz-clib | 5.6.3 | 5.8.1 |