A use-after-free vulnerability exists in the multithreaded LZMA (.xz) decoder of XZ Utils versions 5.6.3 through 5.8.0. This flaw can cause heap corruption and invalid memory writes when processing specially crafted input. Applications using the lzma_stream_decoder_mt function are affected. The issue is fixed in version 5.8.1. The Haskell xz-clib library, which vendors the C implementation, is affected, but the xz package itself is not because it does not use the multithreaded decoder.