Log in Start free

Vulnerability · Published Jun 5, 2026 · Assigned by GitHub_M

CVE-2026-48101GHSL-2026-117: 7-Zip UEFI Capsule uninitialized heap memory disclosure

Medium 6.5

In plain English

A medium-severity security flaw in 7-Zip from mcmilk. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.3%top 79.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

7-Zip is a file archiver with a high compression ratio. Versions 9.21 through 26.00 contain an An uninitialized memory disclosure vulnerability in the UEFI capsule (.scap) parser in 7-Zip. The OpenCapsule function allocates a heap buffer of attacker-declared CapsuleImageSize (up to 1 GiB) without zero-initialization, then reads the file contents into it with ReadStream_FALSE whose return value is silently discarded. If the file is truncated, the unread tail of the buffer retains uninitialized heap memory, which is then exposed as extracted file content via GetStream. Version 26.0.1 fixes the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.247zip26.01-r0ALPINE-CVE-2026-48101
Debian:127zip22.01+really26.01+dfsg-0+deb12u1DEBIAN-CVE-2026-48101
Debian:137zipno fix listedDEBIAN-CVE-2026-48101
Debian:147zip26.01+dfsg-1DEBIAN-CVE-2026-48101
Debian:12p7zip16.02+really26.01+dfsg-0+deb12u1DEBIAN-CVE-2026-48101
Debian:13p7zip16.02+transitional.1DEBIAN-CVE-2026-48101
Ubuntu:25.107zipno fix listedUBUNTU-CVE-2026-48101
Ubuntu:26.04:LTS7zipno fix listedUBUNTU-CVE-2026-48101
Ubuntu:26.107zipno fix listedUBUNTU-CVE-2026-48101
Ubuntu:22.04:LTSp7zipno fix listedUBUNTU-CVE-2026-48101

Affected products (as reported)

VendorProductVersions
mcmilk 7-Zip >= 9.21, < 26.01

Weakness: CWE-908 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References