XZ Utils flaw hits B&R industrial systems
CVE-2025-31115 in XZ Utils 5.3.3alpha–5.8.0 causes crashes and memory corruption in B&R industrial automation products; patches available for affected terminal systems.
B&R Industrial Automation has released patches for CVE-2025-31115, a vulnerability in XZ Utils versions 5.3.3alpha through 5.8.0 affecting multiple industrial terminal and controller products. The flaw in the multithreaded .xz decoder within liblzma can cause heap use-after-free conditions and memory corruption when processing invalid input, potentially leading to system crashes or data corruption. The vulnerability impacts applications using the lzma_stream_decoder_mt function and is remotely exploitable by attackers with network access to affected systems.
Affected products include B&R's PPC3100, C50, C80, FT50, MT50, T30, T80, and T50 terminal systems running vulnerable Terminal OS versions. The vendor has released fixed versions (1.8.0 for C50/C80/T30/T80 and 1.8.1 for PPC3100/FT50/MT50/T50) and recommends immediate patching. ABB PSIRT reported the vulnerability to CISA, and while the issue has been publicly disclosed, no active exploitation has been observed at the time of advisory publication.
The vulnerability affects critical manufacturing infrastructure worldwide. CISA recommends standard ICS security practices including network segmentation, firewall protection, and limiting internet exposure of control systems. Organizations should perform proper risk assessment before deploying mitigations and report any suspected exploitation to CISA.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-181-05
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free