USN-8945-1: Ubuntu patches XZ Utils across all supported releases
Ubuntu has released an update for xz-utils across all supported releases: a malicious compressed file can cause crashes or arbitrary code execution.
UptimeMag editorial team · 21 October 2026 · 2 min read
Ubuntu published security notice USN-8945-1 on 20 October 2026, addressing a vulnerability in the xz-utils package present across all currently supported releases. This affects anyone managing a Linux server: liblzma is the library used to decompress .xz, .lzma and related archive formats, and it is a virtually universal dependency.
The issue
The flaw consists of invalid memory writes during decoder reinitialisation following a memory allocation failure (LP: #2170056). In practice: if an application reuses an xz decoder after a memory allocation has failed, out-of-bounds writes can occur. According to the Ubuntu advisory, an attacker could exploit this to cause a denial of service or, under specific conditions, execute arbitrary code.
The bug is not new: it's the same one tracked upstream by the XZ Utils project as GHSA-5qpq-xqfv-j9pg, discovered by Cantina Security's automated security agent Apex. Upstream already fixed it with the release of XZ Utils 5.8.4, published on 9 September 2026, which addresses selected decoding paths for .lzma, .lz and MicroLZMA formats, leaving .xz decoding and raw decoder APIs unchanged. At present, no CVE number has been assigned: the Debian/Ubuntu changelog explicitly marks it as having no CVE.
Patched versions
| Ubuntu Release | Code name | Patched version |
|---|---|---|
| 26.10 | stonking | 5.8.3-1ubuntu1 |
| 26.04 LTS | resolute | 5.8.3-1ubuntu0.1 |
| 24.04 LTS | noble | 5.6.1+really5.4.5-1ubuntu0.4 |
| 22.04 LTS | jammy | 5.2.5-2ubuntu1.2 |
| 20.04 LTS | focal | 5.2.4-1ubuntu1.1+esm2 (requires Ubuntu Pro) |
| 18.04 LTS | bionic | 5.2.2-1.3ubuntu0.1+esm2 (requires Ubuntu Pro) |
| 16.04 LTS | xenial | 5.1.1alpha+20120614-2ubuntu2.16.04.1+esm3 (Ubuntu Pro + Legacy Support) |
| 14.04 LTS | trusty | 5.1.1alpha+20120614-2ubuntu2.14.04.1+esm3 (Ubuntu Pro + Legacy Support) |
The affected packages are liblzma5, xz-utils and xzdec.
What to do
On all releases still under standard support, the regular update cycle suffices:
sudo apt update && sudo apt upgrade
For 20.04, 18.04, 16.04 and 14.04, the patch is available only with an Ubuntu Pro subscription, which is free for up to five machines. After updating, there is no need to restart services individually: a system reboot or restart of processes linking liblzma (nearly all of them, including many package managers and backup tools) is sufficient to load the correct library.
Written with the help of artificial intelligence and checked by the editors (EU AI Act, art. 50).