CVE-2026-48101: GHSL-2026-115–GHSL-2026-122: Various memory access violations in 7-Zip
7-Zip is a file archiver with a high compression ratio. Versions 9.21 through 26.00 contain an An uninitialized memory disclosure vulnerability in the UEFI capsule (.scap) parser in 7-Zip. The OpenCapsule function allocates a heap buffer of attacker-declared CapsuleImageSize (up to 1 GiB) without zero-initialization, then reads the file contents into it with ReadStreamFALSE whose return value is silently discarded. If the file is truncated, the unread tail of the buffer retains uninitialized heap memory, which is then exposed as extracted file content via GetStream. Version 26.0.1 fixes the issue.
Other sources
The 7-Zip project, version 26.00, contains various memory access violations, out-of-bounds (OOB) read issues, uninitialized memory vulnerabilities, integer overflow flaws in various archive formats (e.g., 7z, SquashFS, UDF, UEFI, WIM, and Ar), and path traversal in sample app, which could potentially lead to compromising system integrity or accessing sensitive data.
— GitHub Security Lab
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
7-Zipto a version that resolves this vulnerability.Fixed in 26.0.1 - Compensating control
If you must keep an affected version temporarily, avoid processing/extracting UEFI capsule (.scap) files with 7-Zip to reduce exposure to the uninitialized memory disclosure in the UEFI capsule parser.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48101?
The severity of CVE-2026-48101 is classified as medium with a score of 6.5.
How do I fix CVE-2026-48101?
To fix CVE-2026-48101, update 7-Zip to version 26.01 or later.
What is the impact of CVE-2026-48101?
CVE-2026-48101 allows for potential information disclosure through uninitialized memory in the UEFI capsule parser.
Which versions of 7-Zip are affected by CVE-2026-48101?
Versions of 7-Zip from 9.21 to 26.00 are affected by CVE-2026-48101.
What type of vulnerability is CVE-2026-48101?
CVE-2026-48101 is an uninitialized memory disclosure vulnerability.