LZMA Memory Allocation Issue in xz by Ulikunitz

CVE-2025-58058

What is CVE-2025-58058?

The xz library, a Golang package for managing xz-compressed files, has a vulnerability in versions before 0.5.14 that allows the insertion of data at the start of an LZMA-encoded byte stream without appropriate detection during header reads. This oversight can result in excessive memory usage as the implementation pre-allocates a decoding buffer upon header reading, despite potential issues not being recognized until stream reading later on. The absence of a magic number or checksum in the LZMA header contributes to this problem. The vulnerability has been addressed in version 0.5.14.

References