Skip to content
OpenAdvisories
High ALAS2023-2026-1820 1 CVE

Important: 7zip security update (Amazon Linux 2023)

Published Jun 8, 2026 · Updated Jun 8, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-48095: A heap buffer overflow vulnerability (GHSL-2026-140) exists in 7-Zip version 26.00, caused by an under-allocation in the NTFS compressed stream buffer (GetCuSize shift UB), potentially allowing attackers to exploit this issue for arbitrary code execution or application crashes.

Fixed packages 9

ReleasePackageFixed in
Amazon Linux · 2023 7zip 0:26.01-14.amzn2023.0.1
Amazon Linux · 2023 7zip-debuginfo 0:26.01-14.amzn2023.0.1
Amazon Linux · 2023 7zip-debugsource 0:26.01-14.amzn2023.0.1
Amazon Linux · 2023 7zip-reduced 0:26.01-14.amzn2023.0.1
Amazon Linux · 2023 7zip-reduced-debuginfo 0:26.01-14.amzn2023.0.1
Amazon Linux · 2023 7zip-standalone 0:26.01-14.amzn2023.0.1
Amazon Linux · 2023 7zip-standalone-all 0:26.01-14.amzn2023.0.1
Amazon Linux · 2023 7zip-standalone-all-debuginfo 0:26.01-14.amzn2023.0.1
Amazon Linux · 2023 7zip-standalone-debuginfo 0:26.01-14.amzn2023.0.1

Vulnerabilities 1

  • High 8.8
    CVE-2026-48095 Public exploit

    GHSL-2026-140_7-Zip: 7-Zip has a heap buffer overflow via NTFS compressed stream buffer under-allocation

    7-Zip is a file archiver with a high compression ratio. Versions 26.00 and prior contain a heap buffer overflow vulnerability caused by an under-allocation in the NTFS compressed stream buffer (GetCuSize shift UB), potentially allowing attackers to cause arbi…

    mcmilk 7-Zip p7zip 7zip Debian Ubuntu Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-48095.html