Log in Start free

Vulnerability · Published Jun 5, 2026 · Assigned by GitHub_M

CVE-2026-48112GHSL-2026-122 7-Zip Ar SYMDEF OOB Read

Medium 6.5

In plain English

A medium-severity integer overflow in 7-Zip from mcmilk. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.3%top 81.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

7-Zip is a file archiver with a high compression ratio. Versions 9.18 through 26.00 contain a heap out-of-bounds read in 7-Zip Ar handler BSD SYMDEF parser. A 4-byte heap out-of-bounds read exists in the Unix ar archive parser in 7-Zip. When parsing a BSD-style __.SYMDEF symbol table, the ParseLibSymbols function reads a 32-bit namesSize field via Get32 at a position that can equal the buffer size, reading 4 bytes past the end of the heap allocation. This reads uninitialized heap data under the default allocator. Version 26.01 patches the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.247zip26.01-r0ALPINE-CVE-2026-48112
Debian:127zip22.01+really26.01+dfsg-0+deb12u1DEBIAN-CVE-2026-48112
Debian:137zipno fix listedDEBIAN-CVE-2026-48112
Debian:147zip26.01+dfsg-1DEBIAN-CVE-2026-48112
Debian:12p7zip16.02+really26.01+dfsg-0+deb12u1DEBIAN-CVE-2026-48112
Debian:13p7zip16.02+transitional.1DEBIAN-CVE-2026-48112
Ubuntu:25.107zipno fix listedUBUNTU-CVE-2026-48112
Ubuntu:26.04:LTS7zipno fix listedUBUNTU-CVE-2026-48112
Ubuntu:26.107zipno fix listedUBUNTU-CVE-2026-48112
Ubuntu:22.04:LTSp7zipno fix listedUBUNTU-CVE-2026-48112

Affected products (as reported)

VendorProductVersions
mcmilk 7-Zip >= 9.34, < 26.01

Weakness: CWE-190, CWE-125 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References