Skip to main content

7-Zip CVE-2026-48112

| EUVDEUVD-2026-34857 MEDIUM
Integer Overflow or Wraparound (CWE-190)
2026-06-05 GitHub_M
Buffer Overflow Integer Overflow 7 Zip Suse Mcmilk
6.5
CVSS 3.1 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
SUSE
3.3 LOW
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

2
Patch available
Jun 05, 2026 - 18:01 EUVD
Analysis Generated
Jun 05, 2026 - 17:27 vuln.today

DescriptionGitHub Advisory

7-Zip is a file archiver with a high compression ratio. Versions 9.18 through 26.00 contain a heap out-of-bounds read in 7-Zip Ar handler BSD SYMDEF parser. A 4-byte heap out-of-bounds read exists in the Unix ar archive parser in 7-Zip. When parsing a BSD-style __.SYMDEF symbol table, the ParseLibSymbols function reads a 32-bit namesSize field via Get32 at a position that can equal the buffer size, reading 4 bytes past the end of the heap allocation. This reads uninitialized heap data under the default allocator. Version 26.01 patches the issue.

AnalysisAI

Heap out-of-bounds read in 7-Zip's Unix ar archive parser (versions 9.18 through 26.00) allows a remote unauthenticated attacker to leak uninitialized heap memory contents by convincing a user to open a specially crafted archive. The ParseLibSymbols function mishandles the BSD-style __.SYMDEF symbol table by reading 4 bytes past the end of a heap allocation when the namesSize field position equals the buffer boundary, exposing heap data with high confidentiality impact. No public exploit has been identified at time of analysis, and no KEV listing exists; version 26.01 patches the issue.

Technical ContextAI

The vulnerability resides in 7-Zip's Ar (Unix archive) format handler, specifically in the ParseLibSymbols function responsible for parsing BSD-style __.SYMDEF symbol tables embedded in .ar archives. The function reads a 32-bit namesSize field using the Get32 helper at an offset that can legally equal the heap allocation's terminal boundary, causing a 4-byte overread into adjacent, uninitialized heap memory under the default allocator. The CWE-190 classification (Integer Overflow or Wraparound) indicates that an integer calculation governing the read position fails to enforce a strict less-than bound check before performing the Get32 read, conflating an at-boundary position with a valid within-bounds position. The affected CPE is cpe:2.3:a:mcmilk:7-zip:*:*:*:*:*:*:*:*, which corresponds to the mcmilk community-maintained fork of 7-Zip; analysts should verify whether the upstream Igor Pavlov distribution shares the identical parser code. The root cause is a boundary condition off-by-one in a 32-bit field extraction, not a memory corruption write - limiting impact to confidentiality.

RemediationAI

The vendor-released patch is 7-Zip version 26.01, which corrects the boundary condition in ParseLibSymbols to prevent the out-of-bounds Get32 read. Users should upgrade to 26.01 or later from their distribution source. The GitHub Security Lab advisory (https://securitylab.github.com/advisories/GHSL-2026-115_GHSL-2026-122_7-zip/) provides additional disclosure context. For environments where immediate upgrade is not feasible, a compensating control is to block or disallow processing of .ar archive files at the gateway or endpoint level, or to restrict 7-Zip usage to trusted archive sources only - noting the trade-off that legitimate Unix ar archives (commonly used in Debian package files and static libraries) would be disrupted. No additional workarounds are described in the available data beyond upgrading to 26.01.

More in 7 Zip

View all
CVE-2016-2334 HIGH POC
7.8 Dec 13

Heap-based buffer overflow in the NArchive::NHfs::CHandler::ExtractZlibFile method in 7zip before 16.00 and p7zip allows
CVE-2016-2335 HIGH POC
8.8 Jun 07

The CInArchive::ReadFileItem method in Archive/Udf/UdfIn.cpp in 7zip 9.20 and 15.05 beta and p7zip allows remote attacke
CVE-2026-14266 HIGH POC
7.8 Jul 15

Heap-based buffer overflow in 7-Zip's XZ archive parser enables arbitrary code execution when a victim opens a crafted a
CVE-2016-9296 HIGH POC
7.5 Nov 12

A null pointer dereference bug affects the 16.02 and many old versions of p7zip. Rated high severity (CVSS 7.5), this vu
CVE-2022-29072 HIGH POC
7.8 Apr 15

7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is d
CVE-2018-10115 HIGH POC
7.8 May 02

Incorrect initialization logic of RAR decoder objects in 7-Zip 18.03 and before can lead to usage of uninitialized memor
CVE-2018-5996 HIGH POC
7.8 Jan 31

Insufficient exception handling in the method NCompress::NRar3::CDecoder::Code of 7-Zip before 18.00 and p7zip can lead

CVE-2015-1038 MEDIUM POC
5.8 Jan 21

p7zip 9.20.1 allows remote attackers to write to arbitrary files via a symlink attack in an archive. Rated medium severi
CVE-2025-53816 MEDIUM POC
5.5 Jul 17

Heap buffer overflow in 7-Zip's RAR5 handler writes zeroes beyond allocated heap memory, causing memory corruption and d
CVE-2026-58052 MEDIUM POC
4.8 Jun 28

Mark-of-the-Web protection is bypassed in 7-Zip for Windows 26.02 and earlier when extracting crafted RAR5 archives, all
CVE-2026-48095 HIGH
8.8 Jun 05

Remote code execution in 7-Zip versions 26.00 and earlier is achievable via a crafted NTFS image that triggers a heap bu
CVE-2018-10172 HIGH
8.8 Apr 16

7-Zip through 18.01 on Windows implements the "Large memory pages" option by calling the LsaAddAccountRights function to

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5
CVE-2016-1010 HIGH
8.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Low
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected

Share

CVE-2026-48112 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy