EUVD-2026-34850Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
7-Zip is a file archiver with a high compression ratio. Versions 9.11 through 26.00 contain a heap out-of-bounds read of up to 3 bytes in the UDF disc image handler's File Identifier Descriptor parser. In CFileId::Parse (CPP/7zip/Archive/Udf/UdfIn.cpp), after validating size < 38 + idLen + impLen and advancing processed to 38 + impLen + idLen, the alignment-padding loop reads p[processed] while incrementing up to 3 times to reach a 4-byte boundary, and the processed <= size bounds check only runs after the loop. When (38 + impLen + idLen) % 4 != 0 and 38 + impLen + idLen == size, the loop reads 1 to 3 bytes past the end of the exact-size heap buffer allocated via buf.Alloc((size_t)item.Size). The UDF handler is registered for .iso and .udf files and auto-detected by signature, and the OOB read triggers during Open() when listing or extracting a crafted UDF image. Impact is limited to information disclosure (a 1-bit oracle per OOB byte via open/fail behavior) and denial of service (crash under hardened allocators); there is no write primitive. Version 26.01 fixes the issue.
AnalysisAI
Heap out-of-bounds read in 7-Zip versions 9.11 through 26.00 exposes up to 3 bytes of heap memory during UDF disc image parsing, triggering when a user opens or extracts a crafted .iso or .udf file. Impact is constrained to a 1-bit information-disclosure oracle per out-of-bounds byte (inferred from open/fail behavior) and potential denial of service under hardened allocators; no write primitive exists. No public exploit code or CISA KEV listing has been identified at time of analysis, and the CVSS Low score of 3.1 accurately reflects the limited real-world severity.
Technical ContextAI
The vulnerability resides in CFileId::Parse within CPP/7zip/Archive/Udf/UdfIn.cpp, the File Identifier Descriptor parser for the UDF (Universal Disk Format) disc image handler. After validating that the field size is less than 38 + idLen + impLen and advancing the processed pointer to 38 + impLen + idLen, an alignment-padding loop increments processed up to three times to reach a 4-byte boundary, reading p[processed] on each iteration. The bounds check (processed <= size) executes only after the loop completes rather than inside it. When the sum (38 + impLen + idLen) equals size exactly and is not divisible by 4, the loop reads 1 to 3 bytes past the end of the heap buffer allocated via buf.Alloc((size_t)item.Size). CWE-125 (Out-of-bounds Read) is the root cause: a post-loop bounds check creates a window where the guard condition is evaluated too late. The UDF handler is auto-registered for .iso and .udf file extensions and also triggers via signature-based detection, meaning the vulnerable code path activates automatically during Open() when listing or extracting archives.
RemediationAI
Upgrade to 7-Zip version 26.01, which fixes the off-by-one bounds check placement in CFileId::Parse so that the processed <= size guard runs inside the alignment-padding loop rather than after it. The advisory and further context are available at https://securitylab.github.com/advisories/GHSL-2026-115_GHSL-2026-122_7-zip/. If immediate upgrade is not possible, a targeted compensating control is to block or quarantine all .iso and .udf files at the organizational perimeter or endpoint before they reach 7-Zip, preventing the auto-detected UDF handler from triggering; note this has an operational cost if UDF images are legitimately used. Disabling UDF association in 7-Zip file type settings (if exposed by the build) would also prevent automatic handler invocation, though this does not protect against explicit extraction commands. Given the Low CVSS severity and High attack complexity, organizations without hardened allocators and without a workflow involving untrusted UDF/ISO files face negligible practical risk from delaying the upgrade.
Heap-based buffer overflow in the NArchive::NHfs::CHandler::ExtractZlibFile method in 7zip before 16.00 and p7zip allows
The CInArchive::ReadFileItem method in Archive/Udf/UdfIn.cpp in 7zip 9.20 and 15.05 beta and p7zip allows remote attacke
Heap-based buffer overflow in 7-Zip's XZ archive parser enables arbitrary code execution when a victim opens a crafted a
A null pointer dereference bug affects the 16.02 and many old versions of p7zip. Rated high severity (CVSS 7.5), this vu
7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is d
Incorrect initialization logic of RAR decoder objects in 7-Zip 18.03 and before can lead to usage of uninitialized memor
Insufficient exception handling in the method NCompress::NRar3::CDecoder::Code of 7-Zip before 18.00 and p7zip can lead
p7zip 9.20.1 allows remote attackers to write to arbitrary files via a symlink attack in an archive. Rated medium severi
Heap buffer overflow in 7-Zip's RAR5 handler writes zeroes beyond allocated heap memory, causing memory corruption and d
Mark-of-the-Web protection is bypassed in 7-Zip for Windows 26.02 and earlier when extracting crafted RAR5 archives, all
Remote code execution in 7-Zip versions 26.00 and earlier is achievable via a crafted NTFS image that triggers a heap bu
7-Zip through 18.01 on Windows implements the "Large memory pages" option by calling the LsaAddAccountRights function to
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today