I am not completely sure about this exploit, but seems like a binary needed to be modified for the exploit to work[1] which was later picked up by build system.

I am not completely sure about this exploit, but seems like a binary needed to be modified for the exploit to work[1] which was later picked up by build system. https://github.com/tukaani-project/xz/commit/6e636819e8f070330d835fce46289a3ff72a7b89 https://github.com/tukaani-project/xz/commit/6e636819e8f0703...