Vulnerability-Lookup

OPENSUSE-SU-2026:11502-1

Vulnerability from csaf_opensuse - Published: 2026-08-13 00:00 - Updated: 2026-09-17 18:38

Summary

7zip-26.02-2.1 on GA media

Severity

Moderate

Notes

Title of the patch: 7zip-26.02-2.1 on GA media

Description of the patch: These are all security issues fixed in the 7zip-26.02-2.1 package on the GA media of openSUSE Tumbleweed.

Patchnames: openSUSE-Tumbleweed-2026-11502

CVE-2026-48092

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:7zip-0:26.02-2.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:7zip-0:26.02-2.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:7zip-0:26.02-2.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:7zip-0:26.02-2.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-48101

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected products

Recommended 4 products, the same list as for CVE-2026-48092

Threats

Impact moderate

CVE-2026-48102

2.5 (Low)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Affected products

Recommended 4 products, the same list as for CVE-2026-48092

Threats

Impact low

CVE-2026-48103

3.3 (Low)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Affected products

Recommended 4 products, the same list as for CVE-2026-48092

Threats

Impact low

CVE-2026-48104

3.6 (Low)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L

Affected products

Recommended 4 products, the same list as for CVE-2026-48092

Threats

Impact low

CVE-2026-48111

3.3 (Low)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Affected products

Recommended 4 products, the same list as for CVE-2026-48092

Threats

Impact low

CVE-2026-48112

3.3 (Low)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Affected products

Recommended 4 products, the same list as for CVE-2026-48092

Threats

Impact low

References

23 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/o…	self
https://www.suse.com/security/cve/CVE-2026-48092/	self
https://www.suse.com/security/cve/CVE-2026-48101/	self
https://www.suse.com/security/cve/CVE-2026-48102/	self
https://www.suse.com/security/cve/CVE-2026-48103/	self
https://www.suse.com/security/cve/CVE-2026-48104/	self
https://www.suse.com/security/cve/CVE-2026-48111/	self
https://www.suse.com/security/cve/CVE-2026-48112/	self
https://www.suse.com/security/cve/CVE-2026-48092	external
https://bugzilla.suse.com/1267858	external
https://www.suse.com/security/cve/CVE-2026-48101	external
https://bugzilla.suse.com/1267859	external
https://www.suse.com/security/cve/CVE-2026-48102	external
https://bugzilla.suse.com/1267860	external
https://www.suse.com/security/cve/CVE-2026-48103	external
https://bugzilla.suse.com/1267861	external
https://www.suse.com/security/cve/CVE-2026-48104	external
https://bugzilla.suse.com/1267862	external
https://www.suse.com/security/cve/CVE-2026-48111	external
https://bugzilla.suse.com/1267863	external
https://www.suse.com/security/cve/CVE-2026-48112	external
https://bugzilla.suse.com/1267864	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "7zip-26.02-2.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the 7zip-26.02-2.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-11502",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11502-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-48092 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-48092/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-48101 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-48101/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-48102 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-48102/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-48103 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-48103/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-48104 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-48104/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-48111 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-48111/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-48112 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-48112/"
      }
    ],
    "title": "7zip-26.02-2.1 on GA media",
    "tracking": {
      "current_release_date": "2026-09-17T18:38:23Z",
      "generator": {
        "date": "2026-08-13T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:11502-1",
      "initial_release_date": "2026-08-13T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-08-13T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-17T18:38:23Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "7zip-0:26.02-2.1.aarch64",
                "product": {
                  "name": "7zip-0:26.02-2.1.aarch64",
                  "product_id": "7zip-0:26.02-2.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:7-zip:7-zip:26.02:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/7zip@26.02-2.1?arch=aarch64\u0026upstream=7zip-0:26.02-2.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "7zip-0:26.02-2.1.ppc64le",
                "product": {
                  "name": "7zip-0:26.02-2.1.ppc64le",
                  "product_id": "7zip-0:26.02-2.1.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:7-zip:7-zip:26.02:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/7zip@26.02-2.1?arch=ppc64le\u0026upstream=7zip-0:26.02-2.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "7zip-0:26.02-2.1.s390x",
                "product": {
                  "name": "7zip-0:26.02-2.1.s390x",
                  "product_id": "7zip-0:26.02-2.1.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:7-zip:7-zip:26.02:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/7zip@26.02-2.1?arch=s390x\u0026upstream=7zip-0:26.02-2.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "7zip-0:26.02-2.1.x86_64",
                "product": {
                  "name": "7zip-0:26.02-2.1.x86_64",
                  "product_id": "7zip-0:26.02-2.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:7-zip:7-zip:26.02:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/7zip@26.02-2.1?arch=x86_64\u0026upstream=7zip-0:26.02-2.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "7zip-0:26.02-2.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:7zip-0:26.02-2.1.aarch64"
        },
        "product_reference": "7zip-0:26.02-2.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "7zip-0:26.02-2.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:7zip-0:26.02-2.1.ppc64le"
        },
        "product_reference": "7zip-0:26.02-2.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "7zip-0:26.02-2.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:7zip-0:26.02-2.1.s390x"
        },
        "product_reference": "7zip-0:26.02-2.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "7zip-0:26.02-2.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:7zip-0:26.02-2.1.x86_64"
        },
        "product_reference": "7zip-0:26.02-2.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-48092",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-48092"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "7-Zip is a file archiver with a high compression ratio. Versions 9.34 through 26.00 contain a heap memory disclosure via SquashFS fragment offset integer overflow on 32-bit builds. 32-bit integer overflow in the SquashFS ReadBlock function allows an attacker-controlled node.Offset value to bypass the fragment bounds check, causing memcpy to read heap memory preceding the cache buffer into the extracted file. The vulnerability is exploitable only on 32-bit builds of 7-Zip where size_t is 32 bits, allowing the addition offsetInBlock + blockSize to wrap modulo 2^2. On 64-bit builds the addition is promoted to 64 bits and the check correctly rejects the input. Version 26.01 patches the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:7zip-0:26.02-2.1.aarch64",
          "openSUSE Tumbleweed:7zip-0:26.02-2.1.ppc64le",
          "openSUSE Tumbleweed:7zip-0:26.02-2.1.s390x",
          "openSUSE Tumbleweed:7zip-0:26.02-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-48092",
          "url": "https://www.suse.com/security/cve/CVE-2026-48092"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1267858 for CVE-2026-48092",
          "url": "https://bugzilla.suse.com/1267858"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.aarch64",
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.ppc64le",
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.s390x",
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.aarch64",
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.ppc64le",
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.s390x",
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-13T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-48092"
    },
    {
      "cve": "CVE-2026-48101",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-48101"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "7-Zip is a file archiver with a high compression ratio. Versions 9.21 through 26.00 contain an An uninitialized memory disclosure vulnerability in the UEFI capsule (.scap) parser in 7-Zip. The OpenCapsule function allocates a heap buffer of attacker-declared CapsuleImageSize (up to 1 GiB) without zero-initialization, then reads the file contents into it with ReadStream_FALSE whose return value is silently discarded. If the file is truncated, the unread tail of the buffer retains uninitialized heap memory, which is then exposed as extracted file content via GetStream. Version 26.0.1 fixes the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:7zip-0:26.02-2.1.aarch64",
          "openSUSE Tumbleweed:7zip-0:26.02-2.1.ppc64le",
          "openSUSE Tumbleweed:7zip-0:26.02-2.1.s390x",
          "openSUSE Tumbleweed:7zip-0:26.02-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-48101",
          "url": "https://www.suse.com/security/cve/CVE-2026-48101"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1267859 for CVE-2026-48101",
          "url": "https://bugzilla.suse.com/1267859"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.aarch64",
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.ppc64le",
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.s390x",
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.aarch64",
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.ppc64le",
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.s390x",
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-13T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-48101"
    },
    {
      "cve": "CVE-2026-48102",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-48102"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "7-Zip is a file archiver with a high compression ratio. Versions 9.11 through 26.00 contain a heap out-of-bounds read of up to 3 bytes in the UDF disc image handler\u0027s File Identifier Descriptor parser. In CFileId::Parse (CPP/7zip/Archive/Udf/UdfIn.cpp), after validating size \u003c 38 + idLen + impLen and advancing processed to 38 + impLen + idLen, the alignment-padding loop reads p[processed] while incrementing up to 3 times to reach a 4-byte boundary, and the processed \u003c= size bounds check only runs after the loop. When (38 + impLen + idLen) % 4 != 0 and 38 + impLen + idLen == size, the loop reads 1 to 3 bytes past the end of the exact-size heap buffer allocated via buf.Alloc((size_t)item.Size). The UDF handler is registered for .iso and .udf files and auto-detected by signature, and the OOB read triggers during Open() when listing or extracting a crafted UDF image. Impact is limited to information disclosure (a 1-bit oracle per OOB byte via open/fail behavior) and denial of service (crash under hardened allocators); there is no write primitive. Version 26.01 fixes the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:7zip-0:26.02-2.1.aarch64",
          "openSUSE Tumbleweed:7zip-0:26.02-2.1.ppc64le",
          "openSUSE Tumbleweed:7zip-0:26.02-2.1.s390x",
          "openSUSE Tumbleweed:7zip-0:26.02-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-48102",
          "url": "https://www.suse.com/security/cve/CVE-2026-48102"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1267860 for CVE-2026-48102",
          "url": "https://bugzilla.suse.com/1267860"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.aarch64",
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.ppc64le",
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.s390x",
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 2.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.aarch64",
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.ppc64le",
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.s390x",
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-13T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2026-48102"
    },
    {
      "cve": "CVE-2026-48103",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-48103"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "7-Zip is a file archiver with a high compression ratio. Versions 9.34 through 26.00 contain an off-by-one heap out-of-bounds read in the WIM (Windows Imaging) archive handler\u0027s security descriptor lookup. In CHandler::GetSecurity (CPP/7zip/Archive/Wim/WimHandler.cpp), the per-image SecurOffsets table holds numEntries + 1 cumulative offsets, but the check securityId \u003e= SecurOffsets.Size() admits securityId == numEntries, and the function then reads SecurOffsets[securityId + 1], fetching one UInt32 past the end of the heap-allocated CRecordVector (which performs no bounds checking on operator[]). The securityId is attacker-controlled at offset +0xC of any directory entry in WIM metadata, and the handler is registered for .wim, .swm, .esd, and .ppkg and enabled by default in stock 7z.dll; the OOB triggers zero-click in the GUI because 7zFM.exe\u0027s ListView calls GetRawProp(kpidNtSecure) for every item during listing (ASan-confirmed), and is also reachable via CLI listing with 7zz l -slt. Impact is limited to denial of service under hardened allocators and minor information disclosure, since the OOB value is only consumed arithmetically as a length and is not surfaced to the attacker; there is no write primitive.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:7zip-0:26.02-2.1.aarch64",
          "openSUSE Tumbleweed:7zip-0:26.02-2.1.ppc64le",
          "openSUSE Tumbleweed:7zip-0:26.02-2.1.s390x",
          "openSUSE Tumbleweed:7zip-0:26.02-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-48103",
          "url": "https://www.suse.com/security/cve/CVE-2026-48103"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1267861 for CVE-2026-48103",
          "url": "https://bugzilla.suse.com/1267861"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.aarch64",
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.ppc64le",
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.s390x",
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.aarch64",
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.ppc64le",
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.s390x",
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-13T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2026-48103"
    },
    {
      "cve": "CVE-2026-48104",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-48104"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "7-Zip is a file archiver with a high compression ratio. Versions 9.18 through 26.00 contain an uninitialized heap read in the SquashFS archive handler caused by a sparsely populated index array. In the SquashFS handler, _blockToNode is allocated with capacity for every metadata block but populated only when an inode crosses a block boundary, so a crafted image with few inodes spanning many blocks leaves most slots holding raw heap contents (the underlying allocator does not zero-initialize POD storage). When OpenDir looks up an attacker-influenced blockIndex (derived from the RootInode superblock field), it reads two of these uninitialized slots and passes them as the left/right bounds of a binary search over _nodesPos, which dereferences the midpoint without bounds checking; if the resulting value happens to match the search key, the returned index is used to read a full node struct from _nodes whose fields feed further directory parsing, forming a chained OOB read primitive that is heap-layout-dependent and not reliably triggerable. The SquashFS handler is enabled by default in stock 7z.dll and the issue triggers during Open() with no interaction beyond opening the file; impact is denial of service from wild-pointer dereference and potential heap information disclosure, with no write primitive. Version 26.01 fixes the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:7zip-0:26.02-2.1.aarch64",
          "openSUSE Tumbleweed:7zip-0:26.02-2.1.ppc64le",
          "openSUSE Tumbleweed:7zip-0:26.02-2.1.s390x",
          "openSUSE Tumbleweed:7zip-0:26.02-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-48104",
          "url": "https://www.suse.com/security/cve/CVE-2026-48104"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1267862 for CVE-2026-48104",
          "url": "https://bugzilla.suse.com/1267862"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.aarch64",
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.ppc64le",
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.s390x",
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.6,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.aarch64",
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.ppc64le",
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.s390x",
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-13T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2026-48104"
    },
    {
      "cve": "CVE-2026-48111",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-48111"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "7-Zip is a file archiver with a high compression ratio. Versions 9.21 through 26.00 contain an off-by-one out-of-bounds read vulnerability in the ParseDepedencyExpression function of the UEFI firmware image parser(CPP/7zip/Archive/UefiHandler.cpp). The function validates an attacker-controlled opcode byte using \u003e instead of \u003e= against the element count of the 10-entry kExpressionCommands static array, allowing an opcode value of 10 to read one pointer slot (8 bytes on x64) past the end of the array in .rodata. The out-of-bounds value is then dereferenced as a const char * and passed through strlen and memcpy into the archive\u0027s Characts property, which may cause either a denial of service (access violation when the adjacent bytes do not form a valid readable pointer) or a minor information disclosure of an adjacent .rdata string literal into archive metadata. The vulnerability is reached automatically during IInArchive::Open() via the call path OpenFv/OpenCapsule -\u003e ParseVolume -\u003e ParseSections when processing a SECTION_DXE_DEPEX (0x13) or SECTION_PEI_DEPEX (0x1B) section whose first body byte is 0x0A, and the UEFI handler is enabled by default in stock 7z.dll with signature-based detection for both UEFIc and UEFIf formats. The outcome (crash vs. silent leak) is deterministic per build but linker-layout dependent, with no write primitive and no disclosure of heap data, secrets, or ASLR base addresses. Version 26.01 fixes the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:7zip-0:26.02-2.1.aarch64",
          "openSUSE Tumbleweed:7zip-0:26.02-2.1.ppc64le",
          "openSUSE Tumbleweed:7zip-0:26.02-2.1.s390x",
          "openSUSE Tumbleweed:7zip-0:26.02-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-48111",
          "url": "https://www.suse.com/security/cve/CVE-2026-48111"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1267863 for CVE-2026-48111",
          "url": "https://bugzilla.suse.com/1267863"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.aarch64",
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.ppc64le",
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.s390x",
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.aarch64",
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.ppc64le",
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.s390x",
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-13T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2026-48111"
    },
    {
      "cve": "CVE-2026-48112",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-48112"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "7-Zip is a file archiver with a high compression ratio. Versions 9.18 through 26.00 contain a heap out-of-bounds read in 7-Zip Ar handler BSD SYMDEF parser. A 4-byte heap out-of-bounds read exists in the Unix ar archive parser in 7-Zip. When parsing a BSD-style __.SYMDEF symbol table, the ParseLibSymbols function reads a 32-bit namesSize field via Get32 at a position that can equal the buffer size, reading 4 bytes past the end of the heap allocation. This reads uninitialized heap data under the default allocator. Version 26.01 patches the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:7zip-0:26.02-2.1.aarch64",
          "openSUSE Tumbleweed:7zip-0:26.02-2.1.ppc64le",
          "openSUSE Tumbleweed:7zip-0:26.02-2.1.s390x",
          "openSUSE Tumbleweed:7zip-0:26.02-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-48112",
          "url": "https://www.suse.com/security/cve/CVE-2026-48112"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1267864 for CVE-2026-48112",
          "url": "https://bugzilla.suse.com/1267864"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.aarch64",
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.ppc64le",
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.s390x",
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.aarch64",
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.ppc64le",
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.s390x",
            "openSUSE Tumbleweed:7zip-0:26.02-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-13T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2026-48112"
    }
  ]
}

CVE-2026-48092 (GCVE-0-2026-48092)

Vulnerability from cvelistv5 – Published: 2026-06-05 13:51 – Updated: 2026-06-08 17:08

Title

7-Zip SquashFS Fragment Offset Overflow (GHSL-2026-116)

Summary

7-Zip is a file archiver with a high compression ratio. Versions 9.34 through 26.00 contain a heap memory disclosure via SquashFS fragment offset integer overflow on 32-bit builds. 32-bit integer overflow in the SquashFS ReadBlock function allows an attacker-controlled node.Offset value to bypass the fragment bounds check, causing memcpy to read heap memory preceding the cache buffer into the extracted file. The vulnerability is exploitable only on 32-bit builds of 7-Zip where size_t is 32 bits, allowing the addition offsetInBlock + blockSize to wrap modulo 2³². On 64-bit builds the addition is promoted to 64 bits and the check correctly rejects the input. Version 26.01 patches the issue.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-08 17:08 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

GitHub_M mitre root

References

1 reference

URL	Tags
https://securitylab.github.com/advisories/GHSL-20…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
mcmilk	7-Zip	Affected: >= 9.34, < 26.01

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48092",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-08T17:08:04.201129Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-08T17:08:54.213Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://securitylab.github.com/advisories/GHSL-2026-115_GHSL-2026-122_7-zip/"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "7-Zip",
          "vendor": "mcmilk",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 9.34, \u003c 26.01"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "7-Zip is a file archiver with a high compression ratio. Versions 9.34 through 26.00 contain a heap memory disclosure via SquashFS fragment offset integer overflow on 32-bit builds. 32-bit integer overflow in the SquashFS ReadBlock function allows an attacker-controlled node.Offset value to bypass the fragment bounds check, causing memcpy to read heap memory preceding the cache buffer into the extracted file. The vulnerability is exploitable only on 32-bit builds of 7-Zip where size_t is 32 bits, allowing the addition offsetInBlock + blockSize to wrap modulo 2\u00b3\u00b2. On 64-bit builds the addition is promoted to 64 bits and the check correctly rejects the input. Version 26.01 patches the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-05T13:54:33.596Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://securitylab.github.com/advisories/GHSL-2026-115_GHSL-2026-122_7-zip/",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://securitylab.github.com/advisories/GHSL-2026-115_GHSL-2026-122_7-zip/"
        }
      ],
      "source": {
        "advisory": "GHSA-fw5r-24vf-c7wq",
        "discovery": "UNKNOWN"
      },
      "title": "7-Zip SquashFS Fragment Offset Overflow (GHSL-2026-116)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-48092",
    "datePublished": "2026-06-05T13:51:55.097Z",
    "dateReserved": "2026-05-20T18:40:45.834Z",
    "dateUpdated": "2026-06-08T17:08:54.213Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-48101 (GCVE-0-2026-48101)

Vulnerability from cvelistv5 – Published: 2026-06-05 15:17 – Updated: 2026-06-05 19:38

Title

GHSL-2026-117: 7-Zip UEFI Capsule uninitialized heap memory disclosure

Summary

7-Zip is a file archiver with a high compression ratio. Versions 9.21 through 26.00 contain an An uninitialized memory disclosure vulnerability in the UEFI capsule (.scap) parser in 7-Zip. The OpenCapsule function allocates a heap buffer of attacker-declared CapsuleImageSize (up to 1 GiB) without zero-initialization, then reads the file contents into it with ReadStream_FALSE whose return value is silently discarded. If the file is truncated, the unread tail of the buffer retains uninitialized heap memory, which is then exposed as extracted file content via GetStream. Version 26.0.1 fixes the issue.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-05 19:38 UTC

CWE

CWE-908 - Use of Uninitialized Resource

Assigner

GitHub_M mitre root

References

1 reference

URL	Tags
https://securitylab.github.com/advisories/GHSL-20…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
mcmilk	7-Zip	Affected: >= 9.21, < 26.01

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48101",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-05T19:38:03.046726Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-05T19:38:15.207Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "7-Zip",
          "vendor": "mcmilk",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 9.21, \u003c 26.01"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "7-Zip is a file archiver with a high compression ratio. Versions 9.21 through 26.00 contain an An uninitialized memory disclosure vulnerability in the UEFI capsule (.scap) parser in 7-Zip. The OpenCapsule function allocates a heap buffer of attacker-declared CapsuleImageSize (up to 1 GiB) without zero-initialization, then reads the file contents into it with ReadStream_FALSE whose return value is silently discarded. If the file is truncated, the unread tail of the buffer retains uninitialized heap memory, which is then exposed as extracted file content via GetStream. Version 26.0.1 fixes the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-908",
              "description": "CWE-908: Use of Uninitialized Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-05T15:17:38.676Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://securitylab.github.com/advisories/GHSL-2026-115_GHSL-2026-122_7-zip/",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://securitylab.github.com/advisories/GHSL-2026-115_GHSL-2026-122_7-zip/"
        }
      ],
      "source": {
        "advisory": "GHSA-ch44-3vgx-78cc",
        "discovery": "UNKNOWN"
      },
      "title": "GHSL-2026-117: 7-Zip UEFI Capsule uninitialized heap memory disclosure"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-48101",
    "datePublished": "2026-06-05T15:17:38.676Z",
    "dateReserved": "2026-05-20T18:40:45.835Z",
    "dateUpdated": "2026-06-05T19:38:15.207Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-48102 (GCVE-0-2026-48102)

Vulnerability from cvelistv5 – Published: 2026-06-05 15:19 – Updated: 2026-06-09 14:37

Title

GHSL-2026-118: 7-Zip UDF Field OOB Read

Summary

7-Zip is a file archiver with a high compression ratio. Versions 9.11 through 26.00 contain a heap out-of-bounds read of up to 3 bytes in the UDF disc image handler's File Identifier Descriptor parser. In CFileId::Parse (CPP/7zip/Archive/Udf/UdfIn.cpp), after validating size < 38 + idLen + impLen and advancing processed to 38 + impLen + idLen, the alignment-padding loop reads p[processed] while incrementing up to 3 times to reach a 4-byte boundary, and the processed <= size bounds check only runs after the loop. When (38 + impLen + idLen) % 4 != 0 and 38 + impLen + idLen == size, the loop reads 1 to 3 bytes past the end of the exact-size heap buffer allocated via buf.Alloc((size_t)item.Size). The UDF handler is registered for .iso and .udf files and auto-detected by signature, and the OOB read triggers during Open() when listing or extracting a crafted UDF image. Impact is limited to information disclosure (a 1-bit oracle per OOB byte via open/fail behavior) and denial of service (crash under hardened allocators); there is no write primitive. Version 26.01 fixes the issue.

Severity

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-09 14:03 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

GitHub_M mitre root

References

1 reference

URL	Tags
https://securitylab.github.com/advisories/GHSL-20…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
mcmilk	7-Zip	Affected: >= 9.11, < 26.01

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48102",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-09T14:03:38.780404Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-09T14:37:34.033Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://securitylab.github.com/advisories/GHSL-2026-115_GHSL-2026-122_7-zip/"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "7-Zip",
          "vendor": "mcmilk",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 9.11, \u003c 26.01"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "7-Zip is a file archiver with a high compression ratio. Versions 9.11 through 26.00 contain a heap out-of-bounds read of up to 3 bytes in the UDF disc image handler\u0027s File Identifier Descriptor parser. In CFileId::Parse (CPP/7zip/Archive/Udf/UdfIn.cpp), after validating size \u003c 38 + idLen + impLen and advancing processed to 38 + impLen + idLen, the alignment-padding loop reads p[processed] while incrementing up to 3 times to reach a 4-byte boundary, and the processed \u003c= size bounds check only runs after the loop. When (38 + impLen + idLen) % 4 != 0 and 38 + impLen + idLen == size, the loop reads 1 to 3 bytes past the end of the exact-size heap buffer allocated via buf.Alloc((size_t)item.Size). The UDF handler is registered for .iso and .udf files and auto-detected by signature, and the OOB read triggers during Open() when listing or extracting a crafted UDF image. Impact is limited to information disclosure (a 1-bit oracle per OOB byte via open/fail behavior) and denial of service (crash under hardened allocators); there is no write primitive. Version 26.01 fixes the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-05T15:19:04.737Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://securitylab.github.com/advisories/GHSL-2026-115_GHSL-2026-122_7-zip/",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://securitylab.github.com/advisories/GHSL-2026-115_GHSL-2026-122_7-zip/"
        }
      ],
      "source": {
        "advisory": "GHSA-455j-xhrg-c54j",
        "discovery": "UNKNOWN"
      },
      "title": "GHSL-2026-118: 7-Zip UDF Field OOB Read"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-48102",
    "datePublished": "2026-06-05T15:19:04.737Z",
    "dateReserved": "2026-05-20T18:40:45.835Z",
    "dateUpdated": "2026-06-09T14:37:34.033Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-48103 (GCVE-0-2026-48103)

Vulnerability from cvelistv5 – Published: 2026-06-05 15:48 – Updated: 2026-06-08 16:07

Title

GHSL-2026-119 7-Zip WIM SecurityId OOB read

Summary

7-Zip is a file archiver with a high compression ratio. Versions 9.34 through 26.00 contain an off-by-one heap out-of-bounds read in the WIM (Windows Imaging) archive handler's security descriptor lookup. In CHandler::GetSecurity (CPP/7zip/Archive/Wim/WimHandler.cpp), the per-image SecurOffsets table holds numEntries + 1 cumulative offsets, but the check securityId >= SecurOffsets.Size() admits securityId == numEntries, and the function then reads SecurOffsets[securityId + 1], fetching one UInt32 past the end of the heap-allocated CRecordVector (which performs no bounds checking on operator[]). The securityId is attacker-controlled at offset +0xC of any directory entry in WIM metadata, and the handler is registered for .wim, .swm, .esd, and .ppkg and enabled by default in stock 7z.dll; the OOB triggers zero-click in the GUI because 7zFM.exe's ListView calls GetRawProp(kpidNtSecure) for every item during listing (ASan-confirmed), and is also reachable via CLI listing with 7zz l -slt. Impact is limited to denial of service under hardened allocators and minor information disclosure, since the OOB value is only consumed arithmetically as a length and is not surfaced to the attacker; there is no write primitive.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-08 16:06 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

GitHub_M mitre root

References

1 reference

URL	Tags
https://securitylab.github.com/advisories/GHSL-20…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
mcmilk	7-Zip	Affected: >= 9.34, < 26.01

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48103",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-08T16:06:56.976839Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-08T16:07:27.768Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://securitylab.github.com/advisories/GHSL-2026-115_GHSL-2026-122_7-zip/"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "7-Zip",
          "vendor": "mcmilk",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 9.34, \u003c 26.01"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "7-Zip is a file archiver with a high compression ratio. Versions 9.34 through 26.00 contain an off-by-one heap out-of-bounds read in the WIM (Windows Imaging) archive handler\u0027s security descriptor lookup. In CHandler::GetSecurity (CPP/7zip/Archive/Wim/WimHandler.cpp), the per-image SecurOffsets table holds numEntries + 1 cumulative offsets, but the check securityId \u003e= SecurOffsets.Size() admits securityId == numEntries, and the function then reads SecurOffsets[securityId + 1], fetching one UInt32 past the end of the heap-allocated CRecordVector (which performs no bounds checking on operator[]). The securityId is attacker-controlled at offset +0xC of any directory entry in WIM metadata, and the handler is registered for .wim, .swm, .esd, and .ppkg and enabled by default in stock 7z.dll; the OOB triggers zero-click in the GUI because 7zFM.exe\u0027s ListView calls GetRawProp(kpidNtSecure) for every item during listing (ASan-confirmed), and is also reachable via CLI listing with 7zz l -slt. Impact is limited to denial of service under hardened allocators and minor information disclosure, since the OOB value is only consumed arithmetically as a length and is not surfaced to the attacker; there is no write primitive."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-05T15:48:49.891Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://securitylab.github.com/advisories/GHSL-2026-115_GHSL-2026-122_7-zip/",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://securitylab.github.com/advisories/GHSL-2026-115_GHSL-2026-122_7-zip/"
        }
      ],
      "source": {
        "advisory": "GHSA-37g2-j8fj-4gf2",
        "discovery": "UNKNOWN"
      },
      "title": "GHSL-2026-119 7-Zip WIM SecurityId OOB read"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-48103",
    "datePublished": "2026-06-05T15:48:49.891Z",
    "dateReserved": "2026-05-20T18:40:45.835Z",
    "dateUpdated": "2026-06-08T16:07:27.768Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-48104 (GCVE-0-2026-48104)

Vulnerability from cvelistv5 – Published: 2026-06-05 15:56 – Updated: 2026-06-05 19:08

Title

GHSL-2026-120: 7-Zip SquashFS BlockToNode uninitialized heap read

Summary

7-Zip is a file archiver with a high compression ratio. Versions 9.18 through 26.00 contain an uninitialized heap read in the SquashFS archive handler caused by a sparsely populated index array. In the SquashFS handler, _blockToNode is allocated with capacity for every metadata block but populated only when an inode crosses a block boundary, so a crafted image with few inodes spanning many blocks leaves most slots holding raw heap contents (the underlying allocator does not zero-initialize POD storage). When OpenDir looks up an attacker-influenced blockIndex (derived from the RootInode superblock field), it reads two of these uninitialized slots and passes them as the left/right bounds of a binary search over _nodesPos, which dereferences the midpoint without bounds checking; if the resulting value happens to match the search key, the returned index is used to read a full node struct from _nodes whose fields feed further directory parsing, forming a chained OOB read primitive that is heap-layout-dependent and not reliably triggerable. The SquashFS handler is enabled by default in stock 7z.dll and the issue triggers during Open() with no interaction beyond opening the file; impact is denial of service from wild-pointer dereference and potential heap information disclosure, with no write primitive. Version 26.01 fixes the issue.

Severity

4.2 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-05 19:08 UTC

CWE

CWE-908 - Use of Uninitialized Resource
CWE-125 - Out-of-bounds Read

Assigner

GitHub_M mitre root

References

1 reference

URL	Tags
https://securitylab.github.com/advisories/GHSL-20…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
mcmilk	7-Zip	Affected: >= 9.18, < 26.01

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48104",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-05T19:08:22.029498Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-05T19:08:26.264Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://securitylab.github.com/advisories/GHSL-2026-115_GHSL-2026-122_7-zip/"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "7-Zip",
          "vendor": "mcmilk",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 9.18, \u003c 26.01"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "7-Zip is a file archiver with a high compression ratio. Versions 9.18 through 26.00 contain an uninitialized heap read in the SquashFS archive handler caused by a sparsely populated index array. In the SquashFS handler, _blockToNode is allocated with capacity for every metadata block but populated only when an inode crosses a block boundary, so a crafted image with few inodes spanning many blocks leaves most slots holding raw heap contents (the underlying allocator does not zero-initialize POD storage). When OpenDir looks up an attacker-influenced blockIndex (derived from the RootInode superblock field), it reads two of these uninitialized slots and passes them as the left/right bounds of a binary search over _nodesPos, which dereferences the midpoint without bounds checking; if the resulting value happens to match the search key, the returned index is used to read a full node struct from _nodes whose fields feed further directory parsing, forming a chained OOB read primitive that is heap-layout-dependent and not reliably triggerable. The SquashFS handler is enabled by default in stock 7z.dll and the issue triggers during Open() with no interaction beyond opening the file; impact is denial of service from wild-pointer dereference and potential heap information disclosure, with no write primitive. Version 26.01 fixes the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-908",
              "description": "CWE-908: Use of Uninitialized Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-05T15:56:34.744Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://securitylab.github.com/advisories/GHSL-2026-115_GHSL-2026-122_7-zip/",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://securitylab.github.com/advisories/GHSL-2026-115_GHSL-2026-122_7-zip/"
        }
      ],
      "source": {
        "advisory": "GHSA-r73g-26rx-2vrg",
        "discovery": "UNKNOWN"
      },
      "title": "GHSL-2026-120: 7-Zip SquashFS BlockToNode uninitialized heap read"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-48104",
    "datePublished": "2026-06-05T15:56:34.744Z",
    "dateReserved": "2026-05-20T18:40:45.836Z",
    "dateUpdated": "2026-06-05T19:08:26.264Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-48111 (GCVE-0-2026-48111)

Vulnerability from cvelistv5 – Published: 2026-06-05 16:09 – Updated: 2026-06-08 17:19

Title

GHSL-2026-121 7-Zip UEFI DEPEX OOB Read

Summary

7-Zip is a file archiver with a high compression ratio. Versions 9.21 through 26.00 contain an off-by-one out-of-bounds read vulnerability in the ParseDepedencyExpression function of the UEFI firmware image parser(CPP/7zip/Archive/UefiHandler.cpp). The function validates an attacker-controlled opcode byte using > instead of >= against the element count of the 10-entry kExpressionCommands static array, allowing an opcode value of 10 to read one pointer slot (8 bytes on x64) past the end of the array in .rodata. The out-of-bounds value is then dereferenced as a const char * and passed through strlen and memcpy into the archive's Characts property, which may cause either a denial of service (access violation when the adjacent bytes do not form a valid readable pointer) or a minor information disclosure of an adjacent .rdata string literal into archive metadata. The vulnerability is reached automatically during IInArchive::Open() via the call path OpenFv/OpenCapsule → ParseVolume → ParseSections when processing a SECTION_DXE_DEPEX (0x13) or SECTION_PEI_DEPEX (0x1B) section whose first body byte is 0x0A, and the UEFI handler is enabled by default in stock 7z.dll with signature-based detection for both UEFIc and UEFIf formats. The outcome (crash vs. silent leak) is deterministic per build but linker-layout dependent, with no write primitive and no disclosure of heap data, secrets, or ASLR base addresses. Version 26.01 fixes the issue.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-08 17:19 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

GitHub_M mitre root

References

1 reference

URL	Tags
https://securitylab.github.com/advisories/GHSL-20…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
mcmilk	7-Zip	Affected: >= 9.18, < 26.01

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48111",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-08T17:19:49.875727Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-08T17:19:57.025Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://securitylab.github.com/advisories/GHSL-2026-115_GHSL-2026-122_7-zip/"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "7-Zip",
          "vendor": "mcmilk",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 9.18, \u003c 26.01"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "7-Zip is a file archiver with a high compression ratio. Versions 9.21 through 26.00 contain an off-by-one out-of-bounds read vulnerability in the ParseDepedencyExpression function of the UEFI firmware image parser(CPP/7zip/Archive/UefiHandler.cpp). The function validates an attacker-controlled opcode byte using \u003e instead of \u003e= against the element count of the 10-entry kExpressionCommands static array, allowing an opcode value of 10 to read one pointer slot (8 bytes on x64) past the end of the array in .rodata. The out-of-bounds value is then dereferenced as a const char * and passed through strlen and memcpy into the archive\u0027s Characts property, which may cause either a denial of service (access violation when the adjacent bytes do not form a valid readable pointer) or a minor information disclosure of an adjacent .rdata string literal into archive metadata. The vulnerability is reached automatically during IInArchive::Open() via the call path OpenFv/OpenCapsule \u2192 ParseVolume \u2192 ParseSections when processing a SECTION_DXE_DEPEX (0x13) or SECTION_PEI_DEPEX (0x1B) section whose first body byte is 0x0A, and the UEFI handler is enabled by default in stock 7z.dll with signature-based detection for both UEFIc and UEFIf formats. The outcome (crash vs. silent leak) is deterministic per build but linker-layout dependent, with no write primitive and no disclosure of heap data, secrets, or ASLR base addresses. Version 26.01 fixes the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-05T16:09:31.039Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://securitylab.github.com/advisories/GHSL-2026-115_GHSL-2026-122_7-zip/",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://securitylab.github.com/advisories/GHSL-2026-115_GHSL-2026-122_7-zip/"
        }
      ],
      "source": {
        "advisory": "GHSA-pg33-4prq-rj7v",
        "discovery": "UNKNOWN"
      },
      "title": "GHSL-2026-121 7-Zip UEFI DEPEX OOB Read"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-48111",
    "datePublished": "2026-06-05T16:09:31.039Z",
    "dateReserved": "2026-05-20T18:46:58.288Z",
    "dateUpdated": "2026-06-08T17:19:57.025Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-48112 (GCVE-0-2026-48112)

Vulnerability from cvelistv5 – Published: 2026-06-05 16:20 – Updated: 2026-06-05 19:38

Title

GHSL-2026-122 7-Zip Ar SYMDEF OOB Read

Summary

7-Zip is a file archiver with a high compression ratio. Versions 9.18 through 26.00 contain a heap out-of-bounds read in 7-Zip Ar handler BSD SYMDEF parser. A 4-byte heap out-of-bounds read exists in the Unix ar archive parser in 7-Zip. When parsing a BSD-style __.SYMDEF symbol table, the ParseLibSymbols function reads a 32-bit namesSize field via Get32 at a position that can equal the buffer size, reading 4 bytes past the end of the heap allocation. This reads uninitialized heap data under the default allocator. Version 26.01 patches the issue.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-05 19:38 UTC

CWE

CWE-190 - Integer Overflow or Wraparound
CWE-125 - Out-of-bounds Read

Assigner

GitHub_M mitre root

References

1 reference

URL	Tags
https://securitylab.github.com/advisories/GHSL-20…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
mcmilk	7-Zip	Affected: >= 9.34, < 26.01

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48112",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-05T19:38:30.375424Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-05T19:38:43.293Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "7-Zip",
          "vendor": "mcmilk",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 9.34, \u003c 26.01"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "7-Zip is a file archiver with a high compression ratio. Versions 9.18 through 26.00 contain a heap out-of-bounds read in 7-Zip Ar handler BSD SYMDEF parser. A 4-byte heap out-of-bounds read exists in the Unix ar archive parser in 7-Zip. When parsing a BSD-style __.SYMDEF symbol table, the ParseLibSymbols function reads a 32-bit namesSize field via Get32 at a position that can equal the buffer size, reading 4 bytes past the end of the heap allocation. This reads uninitialized heap data under the default allocator. Version 26.01 patches the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190: Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-05T16:20:19.633Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://securitylab.github.com/advisories/GHSL-2026-115_GHSL-2026-122_7-zip/",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://securitylab.github.com/advisories/GHSL-2026-115_GHSL-2026-122_7-zip/"
        }
      ],
      "source": {
        "advisory": "GHSA-25fm-vgv2-gvcg",
        "discovery": "UNKNOWN"
      },
      "title": "GHSL-2026-122 7-Zip Ar SYMDEF OOB Read"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-48112",
    "datePublished": "2026-06-05T16:20:19.633Z",
    "dateReserved": "2026-05-20T18:46:58.289Z",
    "dateUpdated": "2026-06-05T19:38:43.293Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

OPENSUSE-SU-2026:11502-1

CVE-2026-48092 (GCVE-0-2026-48092)

CVE-2026-48101 (GCVE-0-2026-48101)

CVE-2026-48102 (GCVE-0-2026-48102)

CVE-2026-48103 (GCVE-0-2026-48103)

CVE-2026-48104 (GCVE-0-2026-48104)

CVE-2026-48111 (GCVE-0-2026-48111)

CVE-2026-48112 (GCVE-0-2026-48112)

Tags

Sightings

Nomenclature

Related by attack behaviour