UPX 5.2.1: executable packing is a size tool, not protection

What happened on 2026-08-27

On 2026-08-27 at 14:01 UTC, UPX published version 5.2.1 on GitHub. Its NEWS entry contains a single 'bug fixes' item pointing to milestone 24. The closed items in that milestone include upx -d reporting a checksum error, some packed linux/arm binaries segfaulting at startup, random SIGSEGV crashes in certain cloud environments for a Go binary compressed with --best --lzma, Go PIE binaries failing to pack because of an e_shstrtab problem, and an off-by-one fix in .shstrtab bounds checking. The release page also notes that the builds for each host are functionally equivalent and points to a pinned issue for security and VirusTotal information.

What it means for protecting app logic

UPX ships its own -d decompression command, which by itself shows the tool is designed to reduce size, not to prevent analysis. Treating UPX packing as code protection is a common misconception: it does not change program logic, and the unpacked code matches the original. This release's fix list shows the cost from another angle: packing adds a runtime step that can cause startup crashes on particular architectures, environments or build configurations. The release page also separates out information about security-software detection, a hint that packed files may draw extra attention from security products when distributed, which should be tested before release rather than assumed.

Checks you can run

If you use UPX, classify it explicitly as a size optimization, not a protection measure, in internal documentation, and do not market it as protection. Test packed programs for startup and regressions on every target platform and runtime environment, especially Go programs and ARM devices. On Windows, pack first and apply the Authenticode signature afterwards, because packing modifies the file, then verify the signature. Before release, check whether common security products flag the packed file. If the size benefit is small, consider not packing at all. Keep the decision and its test results in the release record.

Your checklist

• Classify UPX as a size optimization in docs
• Test packed binaries on every target platform
• Pack before signing and check for false positives before release