Read the docs
TI-2026-35552 Aliases CVE-2026-48112

GHSL-2026-122 7-Zip Ar SYMDEF OOB Read

Priority LOW 28CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.

Summary

7-Zip is a file archiver with a high compression ratio. Versions 9.18 through 26.00 contain a heap out-of-bounds read in 7-Zip Ar handler BSD SYMDEF parser. A 4-byte heap out-of-bounds read exists in the Unix ar archive parser in 7-Zip. When parsing a BSD-style __.SYMDEF symbol table, the ParseLibSymbols function reads a 32-bit namesSize field via Get32 at a position that can equal the buffer size, reading 4 bytes past the end of the heap allocation. This reads uninitialized heap data under the default allocator. Version 26.01 patches the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00267 18th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed 7-Zip (mcmilk): 26.01

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
mcmilk7-Zip9.34 to before 26.0126.01Patch availableCNA
  • 7-Zip Vendormcmilk Affected 9.34 to before 26.01 Fixed in 26.01 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:7-zip:7-zip:*:*:*:*:*:*:*:*9.34 to before 26.01Vulnerable7-Zip
  • cpe:2.3:a:7-zip:7-zip:*:*:*:*:*:*:*:* Versions 9.34 to before 26.01 Vulnerable ·7-Zip

Remediation

  • Fix · CNA 7-Zip (mcmilk) Fixed in 26.01

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-48112

References

Exploit 1

  • TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
  • TI-2026-35535 GHSL-2026-140_7-Zip: 7-Zip has a heap buffer overflow via NTFS compressed stream buffer under-allocation CVSS 3.1HIGH 8.8
  • TI-2026-35532 7-Zip SquashFS Fragment Offset Overflow (GHSL-2026-116) CVSS 3.1HIGH 8.1
  • TI-2026-35551 GHSL-2026-121 7-Zip UEFI DEPEX OOB Read CVSS 3.1HIGH 7.1
  • TI-2026-35543 GHSL-2026-119 7-Zip WIM SecurityId OOB read CVSS 3.1HIGH 7.1
  • TI-2026-35544 GHSL-2026-120: 7-Zip SquashFS BlockToNode uninitialized heap read CVSS 3.1MEDIUM 4.2
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences