Skip to main content

🪐 Backed by $16.5M to build the security workforce for the security workforce. Meet the new Cantina.

Vulnerability disclosure

Empty-index decoding can trigger heap buffer overflow

CVE-2026-34743

Affected product
XZ Utils
Severity
Medium
CVSS
5.3
Weakness
CWE-122
Published

Disclosure summary

CVE-2026-34743 is a medium-severity CWE-122 vulnerability in XZ Utils. Empty-index decoding can trigger heap buffer overflow. Cantina reproduced the behavior, verified its security impact, and coordinated disclosure with the affected maintainer.

Verification standard

Cantina publishes a disclosure only after reproducing the behavior, validating its security impact, and coordinating remediation with the affected project.