A buffer overflow occurs in XZ Utils when the lzma_index_decoder function processes an index containing no records. In this state, the resulting lzma_index is configured so that a subsequent call to lzma_index_append allocates insufficient memory, leading to a memory corruption error. The overflow could be used to overwrite memory and compromise program integrity, potentially allowing arbitrary code execution or causing a crash.

All users of the tukaani-project:xz library running a version older than 5.8.3 are affected. This includes the XZ Utils package found in many Linux distributions, macOS, and other operating systems that rely on this compression tool for file handling or data transfer. The vulnerability applies to any application that employs lzma_index_decoder on empty indices and then appends records via lzma_index_append.

The CVSS score of 1.7 and an EPSS below 1% indicate a low overall risk and a very small probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation to date. Exploitation would require the attacker to supply a crafted index file with no records to an affected application, implying a local or privileged context. No public remote attack vector is described, so the risk remains low without a direct network-facing component.