EUVD-2026-34849Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
7-Zip is a file archiver with a high compression ratio. Versions 9.21 through 26.00 contain an An uninitialized memory disclosure vulnerability in the UEFI capsule (.scap) parser in 7-Zip. The OpenCapsule function allocates a heap buffer of attacker-declared CapsuleImageSize (up to 1 GiB) without zero-initialization, then reads the file contents into it with ReadStream_FALSE whose return value is silently discarded. If the file is truncated, the unread tail of the buffer retains uninitialized heap memory, which is then exposed as extracted file content via GetStream. Version 26.0.1 fixes the issue.
AnalysisAI
Uninitialized heap memory disclosure in 7-Zip's UEFI capsule (.scap) parser exposes potentially sensitive heap contents when an unauthenticated remote attacker delivers a crafted capsule file that a user opens. The OpenCapsule function allocates a heap buffer sized by the attacker-controlled CapsuleImageSize field without zero-initialization, then silently ignores read failures on truncated files, causing the unread tail - containing raw heap data - to be surfaced as extracted file content. Affecting versions 9.21 through 26.00, a fix is available in 26.0.1; no public exploit code has been identified at time of analysis.
Technical ContextAI
7-Zip's UEFI capsule parser (the OpenCapsule function) is responsible for extracting .scap files, a format used for firmware update payloads. The root cause is CWE-908 (Use of Uninitialized Resource): the function allocates a heap buffer whose size is derived directly from the attacker-controlled CapsuleImageSize field in the capsule header - up to 1 GiB - without calling memset or equivalent zero-initialization. It then populates the buffer via ReadStream_FALSE, whose return value indicating partial or failed reads is silently discarded. On a crafted truncated .scap file, the unread tail of the heap buffer retains whatever data previously occupied that memory region (stack frames, freed allocations, other in-process data). This content is subsequently returned to the caller via GetStream as if it were legitimate extracted file content, constituting a heap disclosure. The CPE string cpe:2.3:a:mcmilk:7-zip identifies the mcmilk GitHub-hosted distribution of 7-Zip. Reported under GitHub Security Lab advisories GHSL-2026-115 and GHSL-2026-122.
RemediationAI
Upgrade 7-Zip to version 26.0.1 or later, which resolves the uninitialized heap disclosure by ensuring the buffer is zero-initialized before use and/or properly handling partial reads from ReadStream_FALSE. The fix is referenced in the GitHub Security Lab advisory at https://securitylab.github.com/advisories/GHSL-2026-115_GHSL-2026-122_7-zip/. For environments where immediate patching is not feasible, a targeted workaround is to configure file association policies or 7-Zip's context menu integration to block or warn on .scap (UEFI capsule) files, since the vulnerability is specific to that parser. Alternatively, restrict processing of .scap files at the endpoint or mail gateway level to prevent delivery of crafted capsule files to end users. Note that blocking .scap files at the perimeter has no functional side effect for the vast majority of users who have no legitimate need to extract UEFI capsule archives. No other parser components are implicated by the current CVE description.
Heap-based buffer overflow in the NArchive::NHfs::CHandler::ExtractZlibFile method in 7zip before 16.00 and p7zip allows
The CInArchive::ReadFileItem method in Archive/Udf/UdfIn.cpp in 7zip 9.20 and 15.05 beta and p7zip allows remote attacke
Heap-based buffer overflow in 7-Zip's XZ archive parser enables arbitrary code execution when a victim opens a crafted a
A null pointer dereference bug affects the 16.02 and many old versions of p7zip. Rated high severity (CVSS 7.5), this vu
7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is d
Incorrect initialization logic of RAR decoder objects in 7-Zip 18.03 and before can lead to usage of uninitialized memor
Insufficient exception handling in the method NCompress::NRar3::CDecoder::Code of 7-Zip before 18.00 and p7zip can lead
p7zip 9.20.1 allows remote attackers to write to arbitrary files via a symlink attack in an archive. Rated medium severi
Heap buffer overflow in 7-Zip's RAR5 handler writes zeroes beyond allocated heap memory, causing memory corruption and d
Mark-of-the-Web protection is bypassed in 7-Zip for Windows 26.02 and earlier when extracting crafted RAR5 archives, all
Remote code execution in 7-Zip versions 26.00 and earlier is achievable via a crafted NTFS image that triggers a heap bu
7-Zip through 18.01 on Windows implements the "Large memory pages" option by calling the LsaAddAccountRights function to
Same weakness CWE-908 – Use of Uninitialized Resource
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Desktop 15 SP7 | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP7 | Affected |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | Affected |
| SUSE Linux Enterprise Server 15 SP7 | Affected |
| SUSE Linux Enterprise Server 16.0 | Affected |
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP7 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| openSUSE Leap 16.0 | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | Affected |
| SUSE Linux Enterprise Server 15 SP4-LTSS | Affected |
| SUSE Linux Enterprise Server 15 SP5-LTSS | Affected |
| SUSE Linux Enterprise Server 15 SP6-LTSS | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today