XZ Utils flaw hits B&R industrial systems
CVE-2025-31115 in XZ Utils 5.3.3alpha–5.8.0 causes crashes and memory corruption in B&R industrial automation products; patches available for affected terminal systems.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
B&R Industrial Automation has released patches for CVE-2025-31115, a vulnerability in XZ Utils versions 5.3.3alpha through 5.8.0 affecting multiple industrial terminal and controller products. The flaw in the multithreaded .xz decoder within liblzma can cause heap use-after-free conditions and memory corruption when processing invalid input, potentially leading to system crashes or data corruption. The vulnerability impacts applications using the lzma_stream_decoder_mt function and is remotely exploitable by attackers with network access to affected systems.
Affected products include B&R's PPC3100, C50, C80, FT50, MT50, T30, T80, and T50 terminal systems running vulnerable Terminal OS versions. The vendor has released fixed versions (1.8.0 for C50/C80/T30/T80 and 1.8.1 for PPC3100/FT50/MT50/T50) and recommends immediate patching. ABB PSIRT reported the vulnerability to CISA, and while the issue has been publicly disclosed, no active exploitation has been observed at the time of advisory publication.
The vulnerability affects critical manufacturing infrastructure worldwide. CISA recommends standard ICS security practices including network segmentation, firewall protection, and limiting internet exposure of control systems. Organizations should perform proper risk assessment before deploying mitigations and report any suspected exploitation to CISA.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-181-05
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs