# XZ Utils changelog > XZ Utils release notes. - Vendor: XZ Utils - Category: Developer Tools - Official site: https://tukaani.org/xz/ - Tracked by: What's New (https://whatsnew.fyi/product/xz-utils) - Harvested from: GitHub (tukaani-project/xz) - Entries below: 10 (newest first) What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog. ## Releases ### v5.8.3 — XZ Utils 5.8.3 (stable) - Date: 2026-03-31 - Version: v5.8.3 - Original notes: https://github.com/tukaani-project/xz/releases/tag/v5.8.3 - Permalink: https://whatsnew.fyi/product/xz-utils/releases/v5.8.3 **IMPORTANT:** This includes a fix for CVE-2026-34743 which affects all XZ Utils versions since 5.0.0. No new 5.2.x, 5.4.x, or 5.6.x releases will be made, but the fix is in the v5.2, v5.4, and v5.6 branches in the xz Git repository. ``` 5.8.3 (2026-03-31) * liblzma: - Fix a buffer overflow in lzma_index_append(): If lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. The lzma_index functions are rarely used by applications directly. In the few applications that do use these functions, the combination of function calls required to trigger this bug are unlikely to exist, because there typically is no reason to append Records to a decoded lzma_index. Thus, it's likely that this bug cannot be triggered in any real-world application. The bug was reported and discovered by Cantina using their AppSec agent, Apex. - Fix the build on Windows ARM64EC. - Add "License: 0BSD" to liblzma.pc. * xz: - Fix invalid memory access in --files and --files0. All of the following must be true to trigger it: 1. A string being read (which supposedly is a filename) is at least SIZE_MAX / 2 bytes long. This size is plausible on 32-bit platforms (2 GiB - 1 B). 2. realloc(ptr, SIZE_MAX / 2 + 1) must succeed. On glibc >= 2.30 it shouldn't because the value exceeds PTRDIFF_MAX. 3. An integer overflow results in a realloc(ptr, 0) call. If it doesn't return NULL, then invalid memory access will occur. - On QNX, don't use fsync() on directories because it fails. * Autotools: Enable 32-bit x86 assembler on Hurd by default. It was already enabled in the CMake-based build. * Translations: Add Arabic man page translations. ``` ### v5.8.2 — XZ Utils 5.8.2 (stable) - Date: 2025-12-17 - Version: v5.8.2 - Original notes: https://github.com/tukaani-project/xz/releases/tag/v5.8.2 - Permalink: https://whatsnew.fyi/product/xz-utils/releases/v5.8.2 ``` 5.8.2 (2025-12-17) * liblzma: - Fix the build on ARM64 on glibc versions older than 2.24 (2016). They don't have HWCAP_CRC32 in . - Disable CLMUL CRC code when building for 32-bit x86 with old MSVC versions. This avoids a compiler bug. The exact compiler version in which the issue was fixed is unknown, but VS 2022 17.13 (MSVC 19.43.34808) is known to work, so CLMUL CRC on 32-bit x86 is disabled with MSVC versions older than that. * xz: - Add a workaround for Red Hat Enterprise Linux 9 kernel bug which made xz fail with "xz: Failed to enable the sandbox". It only occurs with xz 5.8.0 and 5.8.1 binaries built for other distros. For example, running Debian 13 in a container on RHEL/CentOS 9 would trigger the issue. The bug was introduced in RHEL 9 kernel 5.14.0-603.el9 (2025-07-30) and fixed in 5.14.0-648.el9 (2025-12-05). However, as of writing, the fixed kernel isn't available to RHEL 9 users yet, so including the workaround in this xz release seems reasonable. The workaround will be removed when it's no longer needed. xzdec was also affected by this issue. - On AIX, don't use fsync() on directories because it fails. - Fix the build on Emscripten. - Fix the build on clang-cl on Windows. - Take resource limits (RLIMIT_DATA, RLIMIT_AS, and RLIMIT_VMEM) into account when determining the default memory usage limit for multithreaded mode. This should prevent xz from failing when a resource limit has been set to a value that is less than 1/4 of total RAM. Other memory limits can still trigger the same issue, for example, Linux cgroup v2 memory.max. * Build systems: - When symbol versioning is enabled, pass --undefined-version to the linker if the option is supported. This fixes the build when using LLVM's lld and some liblzma features have been disabled at build time. - ARM64: Fix autodetection of fast unaligned memory access when using GCC and -mstrict-align is in effect. Previously the build systems would incorrectly guess that unaligned access is fast, which would result in much slower binaries than needed. The fix is a workaround for GCC bug 111555; autodetection already worked with Clang. - LoongArch: Autodetect if fast unaligned memory access is supported. This can improve compression speed by 15 % (but not decompression speed). * Translations: - Update the Spanish translation. - Add Swedish man page translations. - Update Italian, Korean, Romanian, Serbian, and Ukrainian man page translations. ``` ### v5.8.1 — XZ Utils 5.8.1 (stable) - Date: 2025-04-03 - Version: v5.8.1 - Original notes: https://github.com/tukaani-project/xz/releases/tag/v5.8.1 - Permalink: https://whatsnew.fyi/product/xz-utils/releases/v5.8.1 **IMPORTANT:** This includes a security fix for CVE-2025-31115 which affects XZ Utils from 5.3.3alpha to 5.8.0. See the [security advisory](https://tukaani.org/xz/threaded-decoder-early-free.html) for details. ``` 5.8.1 (2025-04-03) * Multithreaded .xz decoder (lzma_stream_decoder_mt()): - Fix a bug that could at least result in a crash with invalid input. (CVE-2025-31115) - Fix a performance bug: Only one thread was used if the whole input file was provided at once to lzma_code(), the output buffer was big enough, timeout was disabled, and LZMA_FINISH was used. There are no bug reports about this, thus it's possible that no real-world application was affected. * Avoid even with C11/C17 compilers. This fixes the build with Oracle Developer Studio 12.6 on Solaris 10 when the compiler is in C11 mode (the header doesn't exist). * Autotools: Restore compatibility with GNU make versions older than 4.0 by creating the package using GNU gettext 0.23.1 infrastructure instead of 0.24. * Update Croatian translation. ``` ### v5.8.0 — XZ Utils 5.8.0 (stable) - Date: 2025-03-25 - Version: v5.8.0 - Original notes: https://github.com/tukaani-project/xz/releases/tag/v5.8.0 - Permalink: https://whatsnew.fyi/product/xz-utils/releases/v5.8.0 ``` 5.8.0 (2025-03-25) This bumps the minor version of liblzma because new features were added. The API and ABI are still backward compatible with liblzma 5.6.x, 5.4.x, 5.2.x, and 5.0.x. * liblzma on 32/64-bit x86: When possible, use SSE2 intrinsics instead of memcpy() in the LZMA/LZMA2 decoder. In typical cases, this may reduce decompression time by 0-5 %. However, when built against musl libc, over 15 % time reduction was observed with highly compressed files. * CMake: Make the feature test macros match the Autotools-based build on NetBSD, Darwin, and mingw-w64. * Update the Croatian, Italian, Portuguese, and Romanian translations. * Update the German, Italian, Korean, Romanian, Serbian, and Ukrainian man page translations. Summary of changes in the 5.7.x development releases: * Mark the following LZMA Utils script aliases as deprecated: lzcmp, lzdiff, lzless, lzmore, lzgrep, lzegrep, and lzfgrep. * liblzma: - Improve LZMA/LZMA2 encoder speed on 64-bit PowerPC (both endiannesses) and those 64-bit RISC-V processors that support fast unaligned access. - Add low-level APIs for RISC-V, ARM64, and x86 BCJ filters to lzma/bcj.h. These are primarily for erofs-utils. - x86/x86-64/E2K CLMUL CRC code was rewritten. - Use the CRC32 instructions on LoongArch. * xz: - Synchronize the output file and its directory using fsync() before deleting the input file. No syncing is done when xz isn't going to delete the input file. - Add --no-sync to disable the sync-before-delete behavior. - Make --single-stream imply --keep. * xz, xzdec, lzmainfo: When printing messages, replace non-printable characters with question marks. * xz and xzdec on Linux: Support Landlock ABI versions 5 and 6. * CMake: Revise the configuration variables and some of their options, and document them in the file INSTALL. CMake support is no longer experimental. (It was already not experimental when building for native Windows.) * Add build-aux/license-check.sh. ``` ### v5.7.2beta — XZ Utils 5.7.2beta (unstable) - Date: 2025-03-08 - Version: v5.7.2beta - Original notes: https://github.com/tukaani-project/xz/releases/tag/v5.7.2beta - Permalink: https://whatsnew.fyi/product/xz-utils/releases/v5.7.2beta - Labels: Pre-release ``` 5.7.2beta (2025-03-08) * On the man pages, mark the following LZMA Utils script aliases as deprecated: lzcmp, lzdiff, lzless, lzmore, lzgrep, lzegrep, and lzfgrep. The commands that start with xz* instead of lz* have identical behavior. The LZMA Utils aliases lzma, unlzma, and lzcat aren't deprecated because some of these aliases are still in common use. lzmadec and lzmainfo aren't deprecated either. * xz: In the ENVIRONMENT section of the man page, warn about problems that some uses of XZ_DEFAULTS and XZ_OPT may create. * Windows (native builds, not Cygwin): In xz, xzdec, and lzmadec, avoid an error message on broken pipe. * Autotools: Fix out-of-tree builds when using the bundled getopt_long. * Translations: - Updated: Chinese (traditional), Croatian, Finnish, Georgian, German, Korean, Polish, Romanian, Serbian, Spanish, Swedish, Turkish, and Ukrainian - Added: Dutch * Man page translations: - Updated: German, Korean, Romanian, and Ukrainian - Added: Italian and Serbian ``` ### v5.7.1alpha — XZ Utils 5.7.1alpha (unstable) - Date: 2025-01-23 - Version: v5.7.1alpha - Original notes: https://github.com/tukaani-project/xz/releases/tag/v5.7.1alpha - Permalink: https://whatsnew.fyi/product/xz-utils/releases/v5.7.1alpha - Labels: Pre-release ``` 5.7.1alpha (2025-01-23) * All fixes from 5.6.4. * liblzma: - Improve LZMA/LZMA2 encoder speed on 64-bit PowerPC (both endiannesses) and those 64-bit RISC-V processors that support fast unaligned access. - x86/x86-64/E2K CLMUL CRC code was rewritten. It's faster and doesn't cause false positives from sanitizers. Attributes like __attribute__((__no_sanitize_address__)) are no longer present. - On 32-bit x86, CLMUL CRC and the old (but still good) assembly versions now co-exist with runtime detection. Both Autotools and CMake build systems handle this automatically now. - Use the CRC32 instructions on LoongArch to make CRC32 calculation faster. - Add low-level APIs for RISC-V, ARM64, and x86 BCJ filters to lzma/bcj.h. These are primarily for erofs-utils. - Minor tweaks to ARM64 CRC32 code and BCJ filters were made. * xz: - Synchronize the output file and its directory before deleting the input file using fsync(). This reduces the probability of data loss after a system crash. However, it can be a major performance hit if processing many small files. NOTE: No syncing is done when xz isn't going to delete the input file. - Add a new option --no-sync to disable the sync-before-delete behavior. It's useful when compressing many small files and one doesn't worry about data loss in case of a system crash. - Make --single-stream imply --keep. - Use automatic word wrapping for the text in --help and similar situations to hopefully make the strings easier for majority of translators (no need to count spaces anymore). * xz, xzdec, lzmainfo: When printing messages, replace non-printable characters with question marks. This way malicious filenames cannot be used to send escape sequences to a terminal. This change is also applied to filenames shown in "xz --robot --list". * xz and xzdec on Linux: Add support for Landlock ABI versions 5 and 6. * CMake updates: - Increase the minimum required CMake version to 3.20. - Revise the configuration variables and some of their options. Document them in the file INSTALL. - Attempt to produce liblzma.pc so that the paths are based on ${prefix}, which makes it simpler to override the paths if the liblzma files have been moved. - To enable translations, gettext-tools is now required. The CMake build no longer supports installing pre-compiled message catalog binary files (po/*.gmo). - Apple: Use Mach-O shared library versioning that is compatible with GNU Libtool. This should make it easier to switch between the build systems on Apple OSes that enforce the correct compatibility_version (macOS >= 12 doesn't?). This change is backward compatible: binaries linked against old CMake-built liblzma will run with liblzma that uses Libtool style versioning. - Windows (not Cygwin): Document CMAKE_DLL_NAME_WITH_SOVERSION (CMake >= 3.27) in the file INSTALL. This option should usually be left to its default value (OFF). It can be set to ON if the liblzma DLL filename must be compatible with the versioned filename produced by GNU Libtool. For example, binaries distributed in MSYS2 use a versioned DLL filename. - CMake support is no longer experimental. (It was already not experimental when building for native Windows.) * Windows: Building liblzma with Visual Studio 2013 is no longer supported. Visual Studio 2015 or later (with CMake) can be used _[Truncated at 4000 characters — full notes: https://github.com/tukaani-project/xz/releases/tag/v5.7.1alpha]_ ### v5.6.4 — XZ Utils 5.6.4 (stable) - Date: 2025-01-23 - Version: v5.6.4 - Original notes: https://github.com/tukaani-project/xz/releases/tag/v5.6.4 - Permalink: https://whatsnew.fyi/product/xz-utils/releases/v5.6.4 ``` 5.6.4 (2025-01-23) * liblzma: Fix LZMA/LZMA2 encoder on big endian ARM64. * xz: - Fix --filters= and --filters1= ... --filters9= options parsing. They require an argument, thus "xz --filters lzma2" should work in addition to "xz --filters=lzma2". - On the man page, note in the --compress and --decompress options that the default behavior is to delete the input file unless writing to standard output. It was already documented in the DESCRIPTION section but new users in a hurry might miss it. * Windows (native builds, not Cygwin): Fix regressions introduced in XZ Utils 5.6.3 which caused non-ASCII characters to display incorrectly. Only builds with translation support were affected (--enable-nls or ENABLE_NLS=ON). The following changes affect builds that have translations enabled: - Require UCRT because MSVCRT doesn't support UTF-8 locales and thus translations won't be readable on Windows 10 version 1903 and later. (MSVCRT builds are still possible with --disable-nls or ENABLE_NLS=OFF.) - Require gettext-runtime >= 0.23.1 because older versions don't autodetect the use of the UTF-8 code page. This resulted in garbled non-ASCII characters even with UCRT. - Partially fix alignment issues in xz --verbose --list with translated messages. Chinese (simplified), Chinese (traditional), and Korean column headings are misaligned still because Windows and MinGW-w64 don't provide wcwidth() and XZ Utils doesn't include a replacement function either. * CMake: Explicitly disable unity builds. This prevents build failures when another project uses XZ Utils via CMake's FetchContent module, and that project enables unity builds. * Update Chinese (traditional) and Serbian translations. ``` ### v5.6.3 — XZ Utils 5.6.3 (stable) - Date: 2024-10-01 - Version: v5.6.3 - Original notes: https://github.com/tukaani-project/xz/releases/tag/v5.6.3 - Permalink: https://whatsnew.fyi/product/xz-utils/releases/v5.6.3 ``` 5.6.3 (2024-10-01) IMPORTANT: This includes a Windows-specific security fix to the command line tools. liblzma isn't affected by this issue. * liblzma: - Fix x86-64 inline assembly compatibility with GNU Binutils older than 2.27. - Fix the build with GCC 4.2 on OpenBSD/sparc64. * xzdec: Display an error instead of failing silently if the unsupported option -M is specified. * lzmainfo: Fix integer overflows when rounding the dictionary and uncompressed sizes to the nearest mebibyte. * Windows (except Cygwin and MSYS2): Add an application manifest to xz, xzdec, lzmadec, and lzmainfo executables: - Declare them compatible with Vista/7/8/8.1/10/11. This way the programs won't needlessly use Operating System Context of Vista when running on later Windows versions. This setting doesn't mean that the executables cannot run on even older versions if otherwise built that way. - Declare them as UAC-compliant. MSVC added this by default already but it wasn't done with MinGW-w64, at least not with all toolchain variants. - Declare them long path aware. This makes long path names work on Windows 10 and 11 if the feature has been enabled in the Windows registry. - Use the UTF-8 code page on Windows 10 version 1903 and later. * Now command line tools can access files whose names contain characters that don't exist in the current legacy code page. * The options --files and --files0 now expect file lists to be in UTF-8 instead of the legacy code page. * This fixes a security issue: If a command line contains Unicode characters (for example, filenames) that don't exist in the current legacy code page, the characters are converted to similar-looking characters with best-fit mapping. Some best-fit mappings result in ASCII characters that change the meaning of the command line, which can be exploited with malicious filenames to do argument injection or directory traversal attacks. UTF-8 avoids best-fit mappings and thus fixes the issue. Forcing the process code page to UTF-8 is possible only on Windows 10 version 1903 and later. The command line tools remain vulnerable if used on an old older version of Windows. This issue was discovered by Orange Tsai and splitline from DEVCORE Research Team. A related smaller issue remains: Windows filenames may contain unpaired surrogates (invalid UTF-16). These are converted to the replacement character U+FFFD in the UTF-8 code page. Thus, filenames with different unpaired surrogates appear identical and aren't distinguishable from filenames that contain the actual replacement character U+FFFD. * When building with MinGW-w64, it is recommended to use UCRT version instead of the old MSVCRT. For example, non-ASCII characters from filenames won't print correctly in messages to console with MSVCRT with the UTF-8 code page (a cosmetic issue). liblzma-only builds are still fine with MSVCRT. - Cygwin and MSYS2 process command line options differently and the above issues don't exist. There is no need to replace the default application manifest on Cygwin and MSYS2. * Autotools-based build: - Fix feature checks with link-time optimization (-flto). - Solaris: Fix a compatibility issue in version.sh. It matters if one wants to rege _[Truncated at 4000 characters — full notes: https://github.com/tukaani-project/xz/releases/tag/v5.6.3]_ ### v5.6.2 — XZ Utils 5.6.2 (stable) - Date: 2024-05-29 - Version: v5.6.2 - Original notes: https://github.com/tukaani-project/xz/releases/tag/v5.6.2 - Permalink: https://whatsnew.fyi/product/xz-utils/releases/v5.6.2 **NOTE:** 5.2.13, 5.4.7, and 5.6.2 have a build system issue that prevents building of shared libraries on some systems like mips64. See the patch itself for details. The same patch applies to 5.2.13, 5.4.7, and 5.6.2. ``` 5.6.2 (2024-05-29) * Remove the backdoor (CVE-2024-3094). * Not changed: Memory sanitizer (MSAN) has a false positive in the CRC CLMUL code which also makes OSS Fuzz unhappy. Valgrind is smarter and doesn't complain. A revision to the CLMUL code is coming anyway and this issue will be cleaned up as part of it. It won't be backported to 5.6.x or 5.4.x because the old code isn't wrong. There is no reason to risk introducing regressions in old branches just to silence a false positive. * liblzma: - lzma_index_decoder() and lzma_index_buffer_decode(): Fix a missing output pointer initialization (*i = NULL) if the functions are called with invalid arguments. The API docs say that such an initialization is always done. In practice this matters very little because the problem can only occur if the calling application has a bug and these functions return LZMA_PROG_ERROR. - lzma_str_to_filters(): Fix a missing output pointer initialization (*error_pos = 0). This is very similar to the fix above. - Fix C standard conformance with function pointer types. - Remove GNU indirect function (IFUNC) support. This is *NOT* done for security reasons even though the backdoor relied on this code. The performance benefits of IFUNC are too tiny in this project to make the extra complexity worth it. - FreeBSD on ARM64: Add error checking to CRC32 instruction support detection. - Fix building with NVIDIA HPC SDK. * xz: - Fix a C standard conformance issue in --block-list parsing (arithmetic on a null pointer). - Fix a warning from GNU groff when processing the man page: "warning: cannot select font 'CW'" * xzdec: Add support for Linux Landlock ABI version 4. xz already had the v3-to-v4 change but it had been forgotten from xzdec. * Autotools-based build system (configure): - Symbol versioning variant can now be overridden with --enable-symbol-versions. Documentation in INSTALL was updated to match. - Add new configure option --enable-doxygen to enable generation and installation of the liblzma API documentation using Doxygen. Documentation in INSTALL and PACKAGERS was updated to match. CMake: - Fix detection of Linux Landlock support. The detection code in CMakeLists.txt had been sabotaged. - Disable symbol versioning on non-glibc Linux to match what the Autotools build does. For example, symbol versioning isn't enabled with musl. - Symbol versioning variant can now be overridden by setting SYMBOL_VERSIONING to "OFF", "generic", or "linux". - Add support for all tests in typical build configurations. Now the only difference to the tests coverage to Autotools is that CMake-based build will skip more tests if features are disabled. Such builds are only for special cases like embedded systems. - Separate the CMake code for the tests into tests/tests.cmake. It is used conditionally, thus it is possible to rm -rf tests and the CMake-based build will still work normally except that no tests are then available. - Add a option ENABLE_DOXYGEN to enable generation and installation of the liblzma API documentation using Doxygen. * Documentation: - Omit the Doxygen-generated liblzma API docume _[Truncated at 4000 characters — full notes: https://github.com/tukaani-project/xz/releases/tag/v5.6.2]_ ### v5.4.7 — XZ Utils 5.4.7 (old stable) - Date: 2024-05-29 - Version: v5.4.7 - Original notes: https://github.com/tukaani-project/xz/releases/tag/v5.4.7 - Permalink: https://whatsnew.fyi/product/xz-utils/releases/v5.4.7 **NOTE:** 5.2.13, 5.4.7, and 5.6.2 have a build system issue that prevents building of shared libraries on some systems like mips64. See the patch itself for details. The same patch applies to 5.2.13, 5.4.7, and 5.6.2. ``` 5.4.7 (2024-05-29) * Not changed: Memory sanitizer (MSAN) has a false positive in the CRC CLMUL code which also makes OSS Fuzz unhappy. Valgrind is smarter and doesn't complain. A revision to the CLMUL code is coming anyway and this issue will be cleaned up as part of it. It won't be backported to 5.6.x or 5.4.x because the old code isn't wrong. There is no reason to risk introducing regressions in old branches just to silence a false positive. * liblzma: - lzma_index_decoder() and lzma_index_buffer_decode(): Fix a missing output pointer initialization (*i = NULL) if the functions are called with invalid arguments. The API docs say that such an initialization is always done. In practice this matters very little because the problem can only occur if the calling application has a bug and these functions return LZMA_PROG_ERROR. - lzma_str_to_filters(): Fix a missing output pointer initialization (*error_pos = 0). This is very similar to the fix above. - Fix C standard conformance with function pointer types. This newly showed up with Clang 17 with -fsanitize=undefined. There are no bug reports about this. - Fix building with NVIDIA HPC SDK. * xz: - Fix a C standard conformance issue in --block-list parsing (arithmetic on a null pointer). - Fix a warning from GNU groff when processing the man page: "warning: cannot select font 'CW'" - Fix outdated threading related information on the man page. * xzless: - With "less" version 451 and later, use "||-" instead of "|-" in the environment variable LESSOPEN. This way compressed files that contain no uncompressed data are shown correctly as empty. - With "less" version 632 and later, use --show-preproc-errors to make "less" show a warning on decompression errors. * Autotools-based build system (configure): - Symbol versioning variant can now be overridden with --enable-symbol-versions. Documentation in INSTALL was updated to match. CMake: - Linux on MicroBlaze is handled specially now. This matches the changes made to the Autotools-based build in XZ Utils 5.4.2 and 5.2.11. - Disable symbol versioning on non-glibc Linux to match what the Autotools build does. For example, symbol versioning isn't enabled with musl. - Symbol versioning variant can now be overridden by setting SYMBOL_VERSIONING to "OFF", "generic", or "linux". * Documentation: - Clarify the description of --disable-assembler in INSTALL. The option only affects 32-bit x86 assembly usage. - Add doc/examples/11_file_info.c. It was added to the Git repository in 2017 but forgotten to be added into distribution tarballs. - Don't install the TODO file as part of the documentation. The file is out of date. - Update home page URLs back to their old locations on tukaani.org. - Update maintainer info. ```