CVE-2026-125742: 7-Zip before 26.06 Heap Out-of-Bounds Write via LZX Decoder in CAB Extraction
7-Zip before 26.06 contains a heap out-of-bounds write vulnerability in the LZX decoder that lets attackers corrupt memory when a continuation CAB volume declares a smaller window. Attackers can entice victims to extract crafted multi-volume CAB archives, where a stale pos value bypasses bounds checks, enabling arbitrary code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
7-Zipto a version that resolves this vulnerability.Fixed in 26.06
Event History
Frequently Asked Questions
What must an attacker provide to trigger the issue?
The attacker needs to entice a victim into extracting a crafted multi-volume CAB archive. The malicious continuation volume declares a smaller LZX window, allowing a stale _pos value to bypass bounds checks.
Is user interaction required?
Yes. The victim must extract the crafted multi-volume CAB archive, so exploitation depends on convincing them to process attacker-controlled files.
Which versions should be remediated?
Versions before 26.06 are affected. Upgrade to 7-Zip 26.06 or later.