Read the docs
TI-2026-35541 Aliases CVE-2026-48101

GHSL-2026-117: 7-Zip UEFI Capsule uninitialized heap memory disclosure

Priority LOW 29CWE-908Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-908 and the CVSS impact.

Summary

7-Zip is a file archiver with a high compression ratio. Versions 9.21 through 26.00 contain an An uninitialized memory disclosure vulnerability in the UEFI capsule (.scap) parser in 7-Zip. The OpenCapsule function allocates a heap buffer of attacker-declared CapsuleImageSize (up to 1 GiB) without zero-initialization, then reads the file contents into it with ReadStream_FALSE whose return value is silently discarded. If the file is truncated, the unread tail of the buffer retains uninitialized heap memory, which is then exposed as extracted file content via GetStream. Version 26.0.1 fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00277 20th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed 7-Zip (mcmilk): 26.01

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
mcmilk7-Zip9.21 to before 26.0126.01Patch availableCNA
  • 7-Zip Vendormcmilk Affected 9.21 to before 26.01 Fixed in 26.01 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:7-zip:7-zip:*:*:*:*:*:*:*:*9.21 to before 26.01Vulnerable7-Zip
  • cpe:2.3:a:7-zip:7-zip:*:*:*:*:*:*:*:* Versions 9.21 to before 26.01 Vulnerable ·7-Zip

Remediation

  • Fix · CNA 7-Zip (mcmilk) Fixed in 26.01

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-48101

References

Exploit 1

  • TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
  • TI-2026-35535 GHSL-2026-140_7-Zip: 7-Zip has a heap buffer overflow via NTFS compressed stream buffer under-allocation CVSS 3.1HIGH 8.8
  • TI-2026-35532 7-Zip SquashFS Fragment Offset Overflow (GHSL-2026-116) CVSS 3.1HIGH 8.1
  • TI-2026-35551 GHSL-2026-121 7-Zip UEFI DEPEX OOB Read CVSS 3.1HIGH 7.1
  • TI-2026-35543 GHSL-2026-119 7-Zip WIM SecurityId OOB read CVSS 3.1HIGH 7.1
  • TI-2026-35544 GHSL-2026-120: 7-Zip SquashFS BlockToNode uninitialized heap read CVSS 3.1MEDIUM 4.2
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences