CVE-2026-48102: GHSL-2026-115–GHSL-2026-122: Various memory access violations in 7-Zip
7-Zip is a file archiver with a high compression ratio. Versions 9.11 through 26.00 contain a heap out-of-bounds read of up to 3 bytes in the UDF disc image handler's File Identifier Descriptor parser. In CFileId::Parse (CPP/7zip/Archive/Udf/UdfIn.cpp), after validating size < 38 + idLen + impLen and advancing processed to 38 + impLen + idLen, the alignment-padding loop reads p[processed] while incrementing up to 3 times to reach a 4-byte boundary, and the processed <= size bounds check only runs after the loop. When (38 + impLen + idLen) % 4 != 0 and 38 + impLen + idLen == size, the loop reads 1 to 3 bytes past the end of the exact-size heap buffer allocated via buf.Alloc((sizet)item.Size). The UDF handler is registered for .iso and .udf files and auto-detected by signature, and the OOB read triggers during Open() when listing or extracting a crafted UDF image. Impact is limited to information disclosure (a 1-bit oracle per OOB byte via open/fail behavior) and denial of service (crash under hardened allocators); there is no write primitive. Version 26.01 fixes the issue.
Other sources
The 7-Zip project, version 26.00, contains various memory access violations, out-of-bounds (OOB) read issues, uninitialized memory vulnerabilities, integer overflow flaws in various archive formats (e.g., 7z, SquashFS, UDF, UEFI, WIM, and Ar), and path traversal in sample app, which could potentially lead to compromising system integrity or accessing sensitive data.
— GitHub Security Lab
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
7-Zipto a version that resolves this vulnerability.Fixed in 26.01 - Compensating control
Since the OOB read in the 7-Zip UDF handler triggers during Open() when listing or extracting a crafted .iso/.udf, restrict or sandbox opening/listing/extracting of untrusted UDF/ISO images (e.g., only allow in a controlled environment) to reduce exposure to crafted inputs.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48102?
The severity of CVE-2026-48102 is classified as low with a score of 3.1.
How do I fix CVE-2026-48102?
To fix CVE-2026-48102, update to the latest version of 7-Zip that addresses this vulnerability.
What versions of 7-Zip are affected by CVE-2026-48102?
CVE-2026-48102 affects 7-Zip versions from 9.11 through 26.00.
What type of vulnerability is CVE-2026-48102?
CVE-2026-48102 is a heap out-of-bounds read vulnerability in the UDF disc image handler.
What components are involved in the CVE-2026-48102 vulnerability?
The CVE-2026-48102 vulnerability involves the File Identifier Descriptor parser in 7-Zip's UDF component.