Critical xz Utils Vulnerability Enables Remote Code Execution

CERT-Bund Security Advisories

Published April 1st, 2026

Detected April 1st, 2026

Summary

CERT-Bund issued a critical security advisory regarding a remote code execution vulnerability in XZ Utils (CVE, CVSS Base Score 9.8). The flaw affects versions prior to 5.8.3 on Linux, UNIX, and related operating systems. Organizations are advised to update immediately as mitigation measures are required to prevent exploitation.

View original document View source feed page

What changed

CERT-Bund published Advisory WID-SEC-2026-0942 warning of a critical vulnerability in XZ Utils versions below 5.8.3. The flaw carries a CVSS Base Score of 9.8 (critical) and temporal score of 8.5 (high), enabling remote anonymous attackers to execute arbitrary code without authentication. Affected systems include Linux, UNIX, and other operating systems utilizing the XZ compression library.

Organizations running vulnerable versions of XZ Utils must immediately update to version 5.8.3 or later. No workaround is available; only patching and applying mitigation measures will address the risk. Given the critical severity and remote exploit capability, security teams should prioritize this update across all affected infrastructure.

What to do next

Immediately identify all systems running XZ Utils versions below 5.8.3
Update XZ Utils to version 5.8.3 or later
Scan for indicators of compromise given the remote code execution capability

Source document (simplified)

[WID-SEC-2026-0942] xz: Schwachstelle ermöglicht Codeausführung CVSS Base Score 9.8 (kritisch) CVSS Temporal Score 8.5 (hoch) Remoteangriff ja Datum 31.03.2026 Stand 01.04.2026 Mitigation ja

Betroffene Systeme

Betriebssystem

Linux
Sonstiges
UNIX

Produktbeschreibung

XZ Utils bietet eine universelle Datenkompressionsbibliothek sowie Befehlszeilenwerkzeuge.

Produkte

31.03.2026
- Open Source xz <5.8.3

Angriff

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in xz ausnutzen, um beliebigen Programmcode auszuführen. CVE Informationen Versionshistorie Feedback zum Advisory geben