CVE-2026-48112: GHSL-2026-115–GHSL-2026-122: Various memory access violations in 7-Zip
7-Zip is a file archiver with a high compression ratio. Versions 9.18 through 26.00 contain a heap out-of-bounds read in 7-Zip Ar handler BSD SYMDEF parser. A 4-byte heap out-of-bounds read exists in the Unix ar archive parser in 7-Zip. When parsing a BSD-style .SYMDEF symbol table, the ParseLibSymbols function reads a 32-bit namesSize field via Get32 at a position that can equal the buffer size, reading 4 bytes past the end of the heap allocation. This reads uninitialized heap data under the default allocator. Version 26.01 patches the issue.
Other sources
The 7-Zip project, version 26.00, contains various memory access violations, out-of-bounds (OOB) read issues, uninitialized memory vulnerabilities, integer overflow flaws in various archive formats (e.g., 7z, SquashFS, UDF, UEFI, WIM, and Ar), and path traversal in sample app, which could potentially lead to compromising system integrity or accessing sensitive data.
— GitHub Security Lab
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
7-Zipto a version that resolves this vulnerability.Fixed in 26.01Patch GHSL-2026-115–GHSL-2026-122 - Upgrade
Upgrade
7-Zipto a version that resolves this vulnerability.Fixed in 26.01Patch GHSL-2026-122 7-Zip Ar SYMDEF OOB Read
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48112?
The severity of CVE-2026-48112 is medium with a score of 6.5.
How do I fix CVE-2026-48112?
To fix CVE-2026-48112, upgrade to 7-Zip version 26.01 or later.
What type of vulnerability is CVE-2026-48112?
CVE-2026-48112 is a heap out-of-bounds read vulnerability in the 7-Zip Ar handler.
Which versions of 7-Zip are affected by CVE-2026-48112?
Versions 9.18 through 26.00 of 7-Zip are affected by CVE-2026-48112.
How can CVE-2026-48112 impact my system?
CVE-2026-48112 can potentially allow an attacker to read sensitive data from memory.