Skip to content
OpenAdvisories
Medium WID-SEC-2026-1736 7 CVEs

7-Zip: Mehrere Schwachstellen

Published May 28, 2026 · Updated Aug 16, 2026 · Revision 9 · de-DE

Vendor: Debian Vendor: Fedora Vendor: HCL Software Vendor: SUSE Product: BigFix Product: Linux Product: Linux Product: Linux Product: openSUSE Platform: Linux Platform: macOS Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in 7-Zip ausnutzen, um Speicherinhalte offenzulegen, einen Denial-of-Service auszulösen oder beliebigen Code auszuführen.

Product

7-Zip ist ein Extraktionsdienstprogramm für Archive, die im ZIP-Format komprimiert sind.

Vulnerabilities 7

  • Medium 6.5
    CVE-2026-48101

    GHSL-2026-117: 7-Zip UEFI Capsule uninitialized heap memory disclosure

    7-Zip is a file archiver with a high compression ratio. Versions 9.21 through 26.00 contain an An uninitialized memory disclosure vulnerability in the UEFI capsule (.scap) parser in 7-Zip. The OpenCapsule function allocates a heap buffer of attacker-declared …

    mcmilk 7-Zip p7zip 7zip Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2026-48112

    GHSL-2026-122 7-Zip Ar SYMDEF OOB Read

    7-Zip is a file archiver with a high compression ratio. Versions 9.18 through 26.00 contain a heap out-of-bounds read in 7-Zip Ar handler BSD SYMDEF parser. A 4-byte heap out-of-bounds read exists in the Unix ar archive parser in 7-Zip. When parsing a BSD-sty…

    mcmilk 7-Zip p7zip 7zip Debian Ubuntu Alpine
  • Medium 4.3
    CVE-2026-48092

    7-Zip SquashFS Fragment Offset Overflow (GHSL-2026-116)

    7-Zip is a file archiver with a high compression ratio. Versions 9.34 through 26.00 contain a heap memory disclosure via SquashFS fragment offset integer overflow on 32-bit builds. 32-bit integer overflow in the SquashFS ReadBlock function allows an attacker-…

    mcmilk 7-Zip p7zip 7zip Debian Ubuntu Alpine
  • Medium 4.3
    CVE-2026-48103

    GHSL-2026-119 7-Zip WIM SecurityId OOB read

    7-Zip is a file archiver with a high compression ratio. Versions 9.34 through 26.00 contain an off-by-one heap out-of-bounds read in the WIM (Windows Imaging) archive handler's security descriptor lookup. In CHandler::GetSecurity (CPP/7zip/Archive/Wim/WimHand…

    mcmilk 7-Zip p7zip 7zip Debian Ubuntu Alpine
  • Medium 4.3
    CVE-2026-48111

    GHSL-2026-121 7-Zip UEFI DEPEX OOB Read

    7-Zip is a file archiver with a high compression ratio. Versions 9.21 through 26.00 contain an off-by-one out-of-bounds read vulnerability in the ParseDepedencyExpression function of the UEFI firmware image parser(CPP/7zip/Archive/UefiHandler.cpp). The functi…

    mcmilk 7-Zip p7zip 7zip Debian Ubuntu Alpine
  • Medium 4.2
    CVE-2026-48104

    GHSL-2026-120: 7-Zip SquashFS BlockToNode uninitialized heap read

    7-Zip is a file archiver with a high compression ratio. Versions 9.18 through 26.00 contain an uninitialized heap read in the SquashFS archive handler caused by a sparsely populated index array. In the SquashFS handler, _blockToNode is allocated with capacity…

    mcmilk 7-Zip p7zip 7zip Debian Ubuntu Alpine
  • Low 3.1
    CVE-2026-48102

    GHSL-2026-118: 7-Zip UDF Field OOB Read

    7-Zip is a file archiver with a high compression ratio. Versions 9.11 through 26.00 contain a heap out-of-bounds read of up to 3 bytes in the UDF disc image handler's File Identifier Descriptor parser. In CFileId::Parse (CPP/7zip/Archive/Udf/UdfIn.cpp), after…

    mcmilk 7-Zip p7zip 7zip Debian Ubuntu Alpine

Revision history

  1. #9

    Neue Updates von openSUSE aufgenommen

  2. #8

    Neue Updates von HCL aufgenommen

  3. #7

    Neue Updates von Debian aufgenommen

  4. #6

    Neue Updates von SUSE aufgenommen

  5. #5

    Neue Updates von SUSE aufgenommen

  6. #4

    Neue Updates von openSUSE aufgenommen

  7. #3

    Neue Updates von Fedora aufgenommen

  8. #2

    CVE ergänzt

  9. #1

    Initiale Fassung

References