Read the docs
TI-2026-35532 Aliases CVE-2026-48092

7-Zip SquashFS Fragment Offset Overflow (GHSL-2026-116)

Priority HIGH 68CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

7-Zip is a file archiver with a high compression ratio. Versions 9.34 through 26.00 contain a heap memory disclosure via SquashFS fragment offset integer overflow on 32-bit builds. 32-bit integer overflow in the SquashFS ReadBlock function allows an attacker-controlled node.Offset value to bypass the fragment bounds check, causing memcpy to read heap memory preceding the cache buffer into the extracted file. The vulnerability is exploitable only on 32-bit builds of 7-Zip where size_t is 32 bits, allowing the addition offsetInBlock + blockSize to wrap modulo 2³². On 64-bit builds the addition is promoted to 64 bits and the check correctly rejects the input. Version 26.01 patches the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.02742 86th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed 7-Zip (mcmilk): 26.01

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
mcmilk7-Zip9.34 to before 26.0126.01Patch availableCNA
  • 7-Zip Vendormcmilk Affected 9.34 to before 26.01 Fixed in 26.01 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:7-zip:7-zip:*:*:*:*:*:*:*:*9.34 to before 26.01Vulnerable7-Zip
  • cpe:2.3:a:7-zip:7-zip:*:*:*:*:*:*:*:* Versions 9.34 to before 26.01 Vulnerable ·7-Zip

Remediation

  • Fix · CNA 7-Zip (mcmilk) Fixed in 26.01

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-48092
  2. 2026-10-25 EPSS moved to the 50th–90th percentile

References

Exploit 1

  • TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
  • TI-2026-35535 GHSL-2026-140_7-Zip: 7-Zip has a heap buffer overflow via NTFS compressed stream buffer under-allocation CVSS 3.1HIGH 8.8
  • TI-2026-35551 GHSL-2026-121 7-Zip UEFI DEPEX OOB Read CVSS 3.1HIGH 7.1
  • TI-2026-35543 GHSL-2026-119 7-Zip WIM SecurityId OOB read CVSS 3.1HIGH 7.1
  • TI-2026-35544 GHSL-2026-120: 7-Zip SquashFS BlockToNode uninitialized heap read CVSS 3.1MEDIUM 4.2
  • TI-2026-35542 GHSL-2026-118: 7-Zip UDF Field OOB Read CVSS 3.1MEDIUM 4.3
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences