CVE-2024-3094 Public exploit Critical · 10.0 EPSS 90.9%

Xz: malicious code in distributed source

Red Hat · Red Hat Enterprise Linux 10

Summary

The xz liblzma library, as shipped in the upstream xz source tarballs starting with version 5.6.0 and affecting Red Hat Enterprise Linux 10, contains malicious code: its build process extracts a prebuilt object file from a disguised test file and uses it to modify specific liblzma functions. Any software linked against the tampered library can have its data interactions intercepted and altered, and an attacker can exploit this remotely over the network without authentication or user interaction.

Official description · CVE.org

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.

Breakdown

35.0 / 100

Exploited: Not confirmed
Reports: 0
Tactics: 0/15

Public exploit code (PoC-in-GitHub) was available the same day.

DisclosedPublic exploit codePoC-in-GitHub29 Mar 2024day 0

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Detection

1 rule for this CVE · 0 general rules for its techniques

Rules for this CVE

1 that reference CVE-2024-3094 directly.

Potential Exploitation of CVE-2024-3094 - Suspicious SSH Child Processhightest

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

What security researchers reported

Not named in any threat report yet

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

54 links, grouped by NVD tag (1 duplicate merged)

Show 42 moreShow fewer

Other 2

redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users binarly.io/blog/persistent-risk-xz-utils-backdoor-still-lurking-in-docker-images

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2024-31700

Public exploitAdvisories link exploit code.

, 30 Oct 2026

90.9%Top 0.19%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.81%).

3.1

10.0Critical · 10.0

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Priority factorsFormula

In a KEV catalognot listed 0.0/35

Recent KEV listingnot listed 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9981 20.0/20

Threat reports0 reports 0.0/10

Public exploit code69 PoC-in-GitHub repos 5.0/5

Mentioned in OTX pulses50 pulses 3.0/3

CVSS base scorebase score 10 7.0/7

End-of-life productsupported or unknown 0.0

Total35.0

Record

Published: 29 Mar 2024
Modified: 4 Aug 2026
: CWE-506 Embedded Malicious Code
Elsewhere: NVD CVE.org JSON

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques