Summary
Empty-index decoding can trigger heap buffer overflow. This medium-severity finding affects XZ Utils.
Disclosure timeline
- Public disclosure
Credits
Cantina · Agent-discovered and human-verified
Vulnerability disclosure
Empty-index decoding can trigger heap buffer overflow
CVE-2026-34743
- Affected product
- XZ Utils
- Severity
- Medium · CVSS 5.3
- Weakness
- CWE-122
- Disclosed