QSearchQSearch

CVE-2026-48092

4.3 MEDIUM

7-Zip is a file archiver with a high compression ratio

Published: 2026-06-05 · Last updated: 2026-06-08

Severity and scoring

CVSS
4.3 MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CWE
CWE-125

Affected products

VendorProduct
7-zip7-zip

Description

7-Zip is a file archiver with a high compression ratio. Versions 9.34 through 26.00 contain a heap memory disclosure via SquashFS fragment offset integer overflow on 32-bit builds. 32-bit integer overflow in the SquashFS ReadBlock function allows an attacker-controlled node.Offset value to bypass the fragment bounds check, causing memcpy to read heap memory preceding the cache buffer into the extracted file. The vulnerability is exploitable only on 32-bit builds of 7-Zip where size_t is 32 bits, allowing the addition offsetInBlock + blockSize to wrap modulo 2³². On 64-bit builds the addition is promoted to 64 bits and the check correctly rejects the input. Version 26.01 patches the issue.

Source: NVD

References

Related CVEs

Same vendor

  • CVE-2026-48112 — 7-Zip is a file archiver with a high compression ratio (6.5 MEDIUM)
  • CVE-2026-48111 — 7-Zip is a file archiver with a high compression ratio (4.3 MEDIUM)
  • CVE-2026-48104 — 7-Zip is a file archiver with a high compression ratio (4.2 MEDIUM)
  • CVE-2026-48103 — 7-Zip is a file archiver with a high compression ratio (4.3 MEDIUM)
  • CVE-2026-48102 — 7-Zip is a file archiver with a high compression ratio (3.1 LOW)

Same CWE

  • CVE-2026-12033 — Out of bounds read in VideoCapture in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the GPU process... (5.3 MEDIUM)
  • CVE-2026-12026 — Out of bounds read in Video in Google Chrome on ChromeOS prior to 149.0.7827.115 allowed a remote attacker who had compromised the render...
  • CVE-2026-52859 — Vim is an open source, command line text editor
  • CVE-2026-47166 — ImageMagick is free and open-source software used for editing and manipulating digital images (5.7 MEDIUM)
  • CVE-2026-45624 — ImageMagick is free and open-source software used for editing and manipulating digital images (5.1 MEDIUM)