Skip to main content

7-Zip CVE-2026-48103

| EUVDEUVD-2026-34852 MEDIUM
Out-of-bounds Read (CWE-125)
2026-06-05 GitHub_M
Buffer Overflow Denial Of Service Information Disclosure Microsoft 7 Zip Suse Mcmilk
4.3
CVSS 3.1 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
4.3 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
SUSE
3.3 LOW
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

Lifecycle Timeline

3
Patch available
Jun 05, 2026 - 18:01 EUVD
Analysis Generated
Jun 05, 2026 - 17:19 vuln.today
CVE Published
Jun 05, 2026 - 15:48 nvd
MEDIUM 4.3

DescriptionGitHub Advisory

7-Zip is a file archiver with a high compression ratio. Versions 9.34 through 26.00 contain an off-by-one heap out-of-bounds read in the WIM (Windows Imaging) archive handler's security descriptor lookup. In CHandler::GetSecurity (CPP/7zip/Archive/Wim/WimHandler.cpp), the per-image SecurOffsets table holds numEntries + 1 cumulative offsets, but the check securityId >= SecurOffsets.Size() admits securityId == numEntries, and the function then reads SecurOffsets[securityId + 1], fetching one UInt32 past the end of the heap-allocated CRecordVector (which performs no bounds checking on operator[]). The securityId is attacker-controlled at offset +0xC of any directory entry in WIM metadata, and the handler is registered for .wim, .swm, .esd, and .ppkg and enabled by default in stock 7z.dll; the OOB triggers zero-click in the GUI because 7zFM.exe's ListView calls GetRawProp(kpidNtSecure) for every item during listing (ASan-confirmed), and is also reachable via CLI listing with 7zz l -slt. Impact is limited to denial of service under hardened allocators and minor information disclosure, since the OOB value is only consumed arithmetically as a length and is not surfaced to the attacker; there is no write primitive.

AnalysisAI

Off-by-one heap out-of-bounds read in 7-Zip's WIM archive handler (versions 9.34-26.00) allows a remote unauthenticated attacker to trigger denial of service - and potentially minor information disclosure - by delivering a crafted WIM file. The vulnerability is zero-click exploitable in the GUI: 7zFM.exe automatically calls GetRawProp(kpidNtSecure) for every listed item, triggering the OOB read without any additional user interaction beyond opening or navigating to the malicious archive. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

The vulnerable code resides in CHandler::GetSecurity within CPP/7zip/Archive/Wim/WimHandler.cpp, which handles the Windows Imaging (WIM) archive format. The WIM handler maintains a per-image SecurOffsets table of numEntries + 1 cumulative offsets. The off-by-one arises because the bounds check securityId >= SecurOffsets.Size() permits securityId to equal numEntries, after which the code dereferences SecurOffsets[securityId + 1] - reading one UInt32 past the end of the heap-allocated CRecordVector, which performs no internal bounds checking on operator[]. The root cause is CWE-125 (Out-of-bounds Read). Critically, the securityId value is attacker-controlled: it resides at offset +0xC within any WIM directory entry embedded in WIM metadata. The handler is registered by default for .wim, .swm, .esd, and .ppkg extensions and is active in stock 7z.dll. The CPE string (cpe:2.3:a:mcmilk:7-zip:*:*:*:*:*:*:*:*) attributes the flaw to the mcmilk-maintained 7-Zip fork on GitHub, though the description also implicates binaries (7zFM.exe, 7zz) associated with official 7-Zip releases - this overlap should be verified with the vendor. The vulnerability has been confirmed via ASan (AddressSanitizer), establishing a reliable crash signal.

RemediationAI

No vendor-released patch with a confirmed fixed version number is available in the provided data. Upstream GitHub Security Lab advisories GHSL-2026-115 and GHSL-2026-122 document the flaw at https://securitylab.github.com/advisories/GHSL-2026-115_GHSL-2026-122_7-zip/ - monitor this advisory and the mcmilk 7-Zip GitHub repository for a patched release. Until a fix is available, the most targeted compensating control is to avoid opening untrusted WIM, SWM, ESD, or PPKG files with 7-Zip directly; these extensions can be disassociated from 7-Zip's file handler registration to prevent accidental GUI triggering. For pipeline or server-side environments that automatically process archives, filter or reject WIM-format inputs at ingestion boundaries as a temporary measure - note this blocks legitimate WIM processing as a side effect. The vulnerability is not exploitable for code execution under current analysis, so urgency of patching is lower than for memory-write primitives; however, updating to the patched release once available remains the definitive remediation.

More in 7 Zip

View all
CVE-2016-2334 HIGH POC
7.8 Dec 13

Heap-based buffer overflow in the NArchive::NHfs::CHandler::ExtractZlibFile method in 7zip before 16.00 and p7zip allows
CVE-2016-2335 HIGH POC
8.8 Jun 07

The CInArchive::ReadFileItem method in Archive/Udf/UdfIn.cpp in 7zip 9.20 and 15.05 beta and p7zip allows remote attacke
CVE-2026-14266 HIGH POC
7.8 Jul 15

Heap-based buffer overflow in 7-Zip's XZ archive parser enables arbitrary code execution when a victim opens a crafted a
CVE-2016-9296 HIGH POC
7.5 Nov 12

A null pointer dereference bug affects the 16.02 and many old versions of p7zip. Rated high severity (CVSS 7.5), this vu
CVE-2022-29072 HIGH POC
7.8 Apr 15

7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is d
CVE-2018-10115 HIGH POC
7.8 May 02

Incorrect initialization logic of RAR decoder objects in 7-Zip 18.03 and before can lead to usage of uninitialized memor
CVE-2018-5996 HIGH POC
7.8 Jan 31

Insufficient exception handling in the method NCompress::NRar3::CDecoder::Code of 7-Zip before 18.00 and p7zip can lead

CVE-2015-1038 MEDIUM POC
5.8 Jan 21

p7zip 9.20.1 allows remote attackers to write to arbitrary files via a symlink attack in an archive. Rated medium severi
CVE-2025-53816 MEDIUM POC
5.5 Jul 17

Heap buffer overflow in 7-Zip's RAR5 handler writes zeroes beyond allocated heap memory, causing memory corruption and d
CVE-2026-58052 MEDIUM POC
4.8 Jun 28

Mark-of-the-Web protection is bypassed in 7-Zip for Windows 26.02 and earlier when extracting crafted RAR5 archives, all
CVE-2026-48095 HIGH
8.8 Jun 05

Remote code execution in 7-Zip versions 26.00 and earlier is achievable via a crafted NTFS image that triggers a heap bu
CVE-2018-10172 HIGH
8.8 Apr 16

7-Zip through 18.01 on Windows implements the "Large memory pages" option by calling the LsaAddAccountRights function to

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Low
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected

Share

CVE-2026-48103 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy