PT-2026-46982 · Mcmilk · 7-Zip

Published 2026-06-05 · Updated 2026-06-05 · CVE-2026-48112

Mitre

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

7-Zip is a file archiver with a high compression ratio. Versions 9.18 through 26.00 contain a heap out-of-bounds read in 7-Zip Ar handler BSD SYMDEF parser. A 4-byte heap out-of-bounds read exists in the Unix ar archive parser in 7-Zip. When parsing a BSD-style .SYMDEF symbol table, the ParseLibSymbols function reads a 32-bit namesSize field via Get32 at a position that can equal the buffer size, reading 4 bytes past the end of the heap allocation. This reads uninitialized heap data under the default allocator. Version 26.01 patches the issue.

Fix

Out of bounds Read

Integer Overflow

Weakness Enumeration

CWE-125

CWE-190

Related Identifiers

CVE-2026-48112

Affected Products

7-Zip

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-48112 · Security Note
• https://securitylab.github.com/advisories/GHSL-2026-115_GHSL-2026-122_7-zip · Note