Log in Start free

Vulnerability · Published Jun 5, 2026 · Assigned by GitHub_M

CVE-2026-480927-Zip SquashFS Fragment Offset Overflow (GHSL-2026-116)

Medium 4.3

In plain English

A medium-severity out-of-bounds read in 7-Zip from mcmilk. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.7% (higher than 86% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)2.7%top 13.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

7-Zip is a file archiver with a high compression ratio. Versions 9.34 through 26.00 contain a heap memory disclosure via SquashFS fragment offset integer overflow on 32-bit builds. 32-bit integer overflow in the SquashFS ReadBlock function allows an attacker-controlled node.Offset value to bypass the fragment bounds check, causing memcpy to read heap memory preceding the cache buffer into the extracted file. The vulnerability is exploitable only on 32-bit builds of 7-Zip where size_t is 32 bits, allowing the addition offsetInBlock + blockSize to wrap modulo 2³². On 64-bit builds the addition is promoted to 64 bits and the check correctly rejects the input. Version 26.01 patches the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.247zip26.01-r0ALPINE-CVE-2026-48092
Debian:127zip22.01+really26.01+dfsg-0+deb12u1DEBIAN-CVE-2026-48092
Debian:137zipno fix listedDEBIAN-CVE-2026-48092
Debian:147zip26.01+dfsg-1DEBIAN-CVE-2026-48092
Debian:12p7zip16.02+really26.01+dfsg-0+deb12u1DEBIAN-CVE-2026-48092
Debian:13p7zip16.02+transitional.1DEBIAN-CVE-2026-48092
Ubuntu:25.107zipno fix listedUBUNTU-CVE-2026-48092
Ubuntu:26.04:LTS7zipno fix listedUBUNTU-CVE-2026-48092
Ubuntu:26.107zipno fix listedUBUNTU-CVE-2026-48092
Ubuntu:22.04:LTSp7zipno fix listedUBUNTU-CVE-2026-48092

Affected products (as reported)

VendorProductVersions
mcmilk 7-Zip >= 9.34, < 26.01

Weakness: CWE-125 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

References