← Fixed vulnerabilities
Fixed
Use-after-free in multi-threaded xz decoder
FreeBSD-SA-25:06.xz · CVE-2025-31115
Our decision for FreeSense
FreeBSD corrected this on 2025-05-07, before the FreeBSD source pin of every FreeSense version.
- Advisory: corrected 2025-05-07
- FreeSense 1.0 pin: e004ff15f87e (2026-08-03)
- FreeSense 1.1 pin: a52c50b4b7c2 (2026-10-04)
- FreeSense 1.2 pin: a52c50b4b7c2 (2026-10-04)
Decided by rules, not yet reviewed. The status comes from the advisory's correction date and the build configuration. A maintainer has not looked at whether FreeSense is exposed in practice. How we triage
By FreeSense version
| Version | Status | FreeBSD pin |
|---|---|---|
| FreeSense 1.01.0.7 · frozen, no further fixes | FixedFreeBSD pin of 2026-08-03 | 2026-08-03e004ff15 |
| FreeSense 1.11.1.9 | FixedFreeBSD pin of 2026-10-04 | 2026-10-04a52c50b4 |
| FreeSense 1.21.2.0-DEVELOPMENT | FixedFreeBSD pin of 2026-10-04 | 2026-10-04a52c50b4 |
Workaround
No workaround is available, but systems where xz decoding was not used in multi-threaded mode are not affected.
What FreeBSD says
A worker thread could free its input buffer after decoding, while the main thread might still be writing to it. This leads to an use-after-free condition on heap memory.
Impact
An attacker may use specifically crafted .xz file to cause multi-threaded xz decoder to crash, or potentially run arbitrary code under the credential the decoder was executed.
Excerpt from the FreeBSD advisory. Read the original for the full text and the fix.