CVE-2026-34743 is a vulnerability in XZ Utils where the lzma_index_decoder() function, when handling an empty index and a subsequent lzma_index_append() call, allocates insufficient memory. This leads to a buffer overflow that can cause denial of service by crashing or restarting affected systems. The issue is classified under CWE-131 (Incorrect Calculation of Buffer Size). Red Hat has issued an advisory indicating affected RPM packages for Red Hat Hardened Images on aarch64 and x86_64 architectures. The advisory references updated RPM versions (xz-5.8.3-1.1.hum1 and related packages). The vulnerability has a medium severity rating and no CVSS score is provided. Red Hat's advisory notes that scoring may differ from other sources due to product-specific factors. No known exploits in the wild have been reported.

The vulnerability can cause denial of service (DoS) by triggering a buffer overflow due to insufficient memory allocation during index decoding in XZ Utils. This may result in application or system crashes. There is no indication of confidentiality or integrity impact. No known active exploitation has been reported.

Red Hat has released updated RPM packages (xz-5.8.3-1.1.hum1 and related) addressing this issue. Users should apply these updates to affected Red Hat Hardened Images and related products. Since this is not a cloud service, remediation is the responsibility of the system administrators. If updates are not immediately available, consider applying any vendor-provided mitigations or consult Red Hat support. Patch status is not explicitly confirmed in the advisory text; users should verify the availability of fixes via the official Red Hat advisory linked in the report.