XZ Utils liblzma Multithreaded Decoder Race Condition Impacting B&R Industrial Automation Products

Technical Analysis

CVE-2025-31115 is a CWE-366 race condition within a thread affecting XZ Utils versions 5.3.3alpha through 5.8.0, specifically in the multithreaded .xz decoder within liblzma when processing invalid input via the lzma_stream_decoder_mt function. Exploitation can trigger heap use-after-free conditions and null-pointer-based memory writes, leading to crashes or potential memory corruption (CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H — network-exploitable, no privileges or user interaction required, availability impact only). The vulnerability affects B&R industrial HMI/panel products (PPC3100, C50, C80, FT50, MT50, T30, T80, T50) that bundle vulnerable liblzma versions; B&R has released fixed firmware (versions 1.8.0/1.8.1) and the upstream fix is committed to XZ Utils 5.8.1 and later branches. This is a direct OT/ICS issue with no ransomware or APT campaign attribution noted, and no known active exploitation as of publication. Impact to AI agent systems is limited but plausible: any AI agent orchestration or monitoring tooling that ingests compressed telemetry or logs from these industrial devices using vulnerable liblzma-linked decompression libraries could be exposed to crashes or DoS if processing maliciously crafted .xz streams, warranting supply-chain awareness for agent-adjacent data pipelines.

Affected Systems

B&R Industrial Automation GmbH products using XZ Utils/liblzma versions 5.3.3alpha–5.8.0: PPC3100 (<1.8.1), C50 (<1.8.0), C80 (<1.8.0), FT50 (<1.8.1), MT50 (<1.8.1), T30 (<1.8.0), T80 (<1.8.0), T50 (<1.8.1). Broader impact possible for any application or library using lzma_stream_decoder_mt from affected XZ Utils versions.

Indicators of Compromise

• No specific IOCs published; vulnerability advisory only, no known exploitation observed at time of disclosure.

Remediation Steps

1. 1

   Apply vendor firmware updates

   Update affected B&R products to the fixed Terminal OS versions: PPC3100 1.8.1, C50 1.8.0, C80 1.8.0, FT50 1.8.1, MT50 1.8.1, T30 1.8.0, T80 1.8.0, T50 1.8.1, following the vendor's user manual update process.

2. 2

   Upgrade XZ Utils/liblzma dependency

   For any custom or third-party systems using XZ Utils, upgrade to version 5.8.1 or later, or apply the standalone patch to older stable branches (v5.4, v5.6, v5.8).

3. 3

   Network segmentation and isolation

   Ensure control system devices are not directly accessible from the internet; place them behind firewalls and separate from business networks, minimizing exposed ports.

4. 4

   Secure remote access

   Use VPNs with up-to-date patching for any required remote access to control system networks, recognizing that VPN security depends on the security of connected endpoints.

5. 5

   Monitor and report anomalies

   Monitor systems for unexpected crashes or instability that could indicate exploitation attempts and report suspicious activity to CISA and B&R/ABB PSIRT.