GHSA-jc7w-c686-c4v9Published
github.com/ulikunitz/xz leaks memory when decoding a corrupted multiple LZMA archives
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2025-58058 · Microsoft / collected KEV context
cve-program · CVE-2025-58058
- https://github.com/ulikunitz/xz/security/advisories/GHSA-jc7w-c686-c4v9
- https://github.com/ulikunitz/xz/commit/88ddf1d0d98d688db65de034f48960b2760d2ae2
euvd · EUVD-2025-26149
- https://github.com/ulikunitz/xz/security/advisories/GHSA-jc7w-c686-c4v9
- https://github.com/ulikunitz/xz/commit/88ddf1d0d98d688db65de034f48960b2760d2ae2
nvd · CVE-2025-58058
- https://github.com/ulikunitz/xz/commit/88ddf1d0d98d688db65de034f48960b2760d2ae2
- https://github.com/ulikunitz/xz/security/advisories/GHSA-jc7w-c686-c4v9
osv · GHSA-jc7w-c686-c4v9
- https://github.com/ulikunitz/xz/security/advisories/GHSA-jc7w-c686-c4v9
- https://nvd.nist.gov/vuln/detail/CVE-2025-58058
- https://github.com/ulikunitz/xz/commit/88ddf1d0d98d688db65de034f48960b2760d2ae2
- https://github.com/ulikunitz/xz
osv · GO-2025-3922
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.