CVE-2024-3094: Xz: malicious code in distributed source
Last updated 4 August 2025
Other sources
Malicious code discovered in the tarballs distributed from upstream sources beginning in 5.6.0.
— Red Hat
Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.
— Launchpad
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3094?
CVE-2024-3094 is classified as a high severity vulnerability due to the presence of malicious code in upstream tarballs.
How do I fix CVE-2024-3094?
To address CVE-2024-3094, update to a version of xz-utils that is not affected, such as 5.2.5-2.1~deb11u1 or later.
Which versions of xz-utils are affected by CVE-2024-3094?
CVE-2024-3094 affects xz-utils versions 5.6.0 and 5.6.1.
What systems are impacted by CVE-2024-3094?
CVE-2024-3094 impacts systems using xz-utils version 5.6.0 and above, commonly found in many Linux distributions.
Is there a backdoor associated with CVE-2024-3094?
Yes, CVE-2024-3094 involves a backdoor introduced in the tarballs distributed from upstream sources.