An XZ archive is a compressed file container used to store data in blocks along with metadata such as sizes and indexes. The format is designed for efficient compression, but that structure also means software must parse attacker-controlled fields before it can safely extract anything.
In cyber security, that parser becomes a security boundary. If length fields, chunk boundaries, or block metadata are handled incorrectly, a crafted .xz file can trigger memory corruption in the decompression code, sometimes leading to crashes or code execution in the current process. Attackers may deliver malicious archives through email, downloads, or automated file pipelines, while defenders reduce risk by patching archive tools, sandboxing extraction, and treating external archives as untrusted input.