What’s Vulnerable › Vulnerabilities
CVE-2026-48112: GHSL-2026-122 7-Zip Ar SYMDEF OOB Read
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2026-06-05 · updated 2026-06-17
- Weakness: CWE-125
Description
7-Zip is a file archiver with a high compression ratio. Versions 9.18 through 26.00 contain a heap out-of-bounds read in 7-Zip Ar handler BSD SYMDEF parser. A 4-byte heap out-of-bounds read exists in the Unix ar archive parser in 7-Zip. When parsing a BSD-style __.SYMDEF symbol table, the ParseLibSymbols function reads a 32-bit namesSize field via Get32 at a position that can equal the buffer size, reading 4 bytes past the end of the heap allocation. This reads uninitialized heap data under the default allocator. Version 26.01 patches the issue.
Affected products
- 7-Zip: from 9.34 before 26.01 — fixed in 26.01
How to fix
Upgrade to a fixed version: 7-Zip 26.01. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-48112 or the next vulnerability affects your stack