PT-2026-48535 · Rikyoz · Bit7Z

Published 2026-06-10 · Updated 2026-06-10 · CVE-2026-45384

Mitre

CVSS v3.1

6.1

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

bit7z is a cross-platform C++ static library that allows the compression/extraction of archive files. Prior to version 4.0.12, there is an arbitrary file overwrite vulnerability via symlink attack on predictable temp files during archive update. This issue has been patched in version 4.0.12.

Fix

Link Following

Weakness Enumeration

CWE-377

CWE-59

Related Identifiers

CVE-2026-45384

Affected Products

Bit7Z

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-45384 · Security Note
• https://github.com/rikyoz/bit7z/security/advisories/GHSA-wjch-42rm-q53h · Note
• https://github.com/rikyoz/bit7z/releases/tag/v4.0.12 · Note