Description
7-Zip before 26.06 contains a heap out-of-bounds write vulnerability in the LZX decoder that lets attackers corrupt memory when a continuation CAB volume declares a smaller window. Attackers can entice victims to extract crafted multi-volume CAB archives, where a stale _pos value bypasses bounds checks, enabling arbitrary code execution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| 7-Zip | 7-Zip | < 26.06 | 26.06 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | 7zip | 26.06+dfsg-1 | — |
| Debian 13 | 7zip | No fix yet | — |
| Debian 13 | p7zip | 16.02+transitional.1 | — |
| Debian 12 | 7zip +1 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | 7zip | No fix yet | — |
| Ubuntu 26.04 LTS | 7zip | No fix yet | — |
| Ubuntu 22.04 LTS | p7zip | No fix yet | — |
| Ubuntu 20.04 LTS | p7zip | No fix yet | — |
| Ubuntu 18.04 LTS | p7zip | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | p7zip | No fix yet | — |
| Ubuntu 14.04 LTS | p7zip | No fix yet | — |
| Ubuntu Pro 24.04 LTS | 7zip | No fix yet | — |
| Ubuntu Pro 22.04 LTS | 7zip | No fix yet | — |
Advisories 1
- WID-SEC-2026-4448 7-Zip: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
References
- https://github.com/ip7z/7zip/commit/d3296e39e1f1f92c7b41c0c3848e65640428d42d patch
- 7-Zip 26.06 Release Notes release-notes
- https://github.com/ip7z/7zip/blob/26.05/CPP/7zip/Compress/LzxDecoder.cpp#L1496-L1513 product
- https://potion-brew.pages.dev/posts/7zip-cab-lzx-window-desync-rce/ technical-description exploit
- VulnCheck Advisory: 7-Zip before 26.06 Heap Out-of-Bounds Write via LZX Decoder in CAB Extraction third-party-advisory