xz: Race Condition within a Thread
CVE-2025-31115 is a high-severity race condition within a thread vulnerability in xz from Tukaani-project, with a CVSS 4.0 base score of 8.7 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. Affected xz versions: >= 5.3.3alpha, < 5.8.1. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 0.68% chance of exploitation within 30 days, higher than 53% of scored CVEs.
High severity with no evidence of exploitation so far.
What to do
- Check which version of xz you run against the affected versions below, and install the vendor's latest release.
- Read the advisory on github.com for workarounds and exact fixed builds.
- Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Tukaani-project | xz | >= 5.3.3alpha, < 5.8.1 | Not stated |
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP | V3.1.5 and later | Not stated |
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP | V3.1.5 and later | Not stated |
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP | V3.1.5 and later | Not stated |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Attack requirements
- NoneThe attack does not depend on a particular deployment or configuration.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Confidentiality (vulnerable system)
- NoneNo loss of confidentiality on the vulnerable system.
- Integrity (vulnerable system)
- NoneNo loss of integrity on the vulnerable system.
- Availability (vulnerable system)
- HighSerious loss of availability on the vulnerable system.
- Confidentiality (other systems)
- NoneNo loss of confidentiality on systems beyond the vulnerable one.
- Integrity (other systems)
- NoneNo loss of integrity on systems beyond the vulnerable one.
- Availability (other systems)
- NoneNo loss of availability on systems beyond the vulnerable one.
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. Scored by CNA (github.com).
Official description
XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects include heap use after free and writing to an address based on the null pointer plus an offset. Applications and libraries that use the lzma_stream_decoder_mt function are affected. The bug has been fixed in XZ Utils 5.8.1, and the fix has been committed to the v5.4, v5.6, v5.8, and master branches in the xz Git repository. No new release packages will be made from the old stable branches, but a standalone patch is available that applies to all affected releases.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Race Condition within a Thread
If two threads of execution use a resource simultaneously, there exists the possibility that resources may be used while invalid, in turn making the state of execution undefined.
How developers prevent this class of flaw
- Use locking functionality. This is the recommended solution. Implement some form of locking mechanism around code which alters or reads persistent data in a multithreaded environment.
- Create resource-locking validation checks. If no inherent locking mechanisms exist, use flags and signals to enforce your own blocking scheme when resources are being used by other threads of execution.
More Race Condition within a Thread vulnerabilities (CWE-366)
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
Other references
Recent Race Condition within a Thread vulnerabilities
- 7.0 High severity
Spotted an error? Tell us.