7-Zip is a file archiver with a high compression ratio. Versions 26.00 and prior contain a heap buffer overflow vulnerability caused by an under-allocation in the NTFS compressed stream buffer (GetCuSize shift UB), potentially allowing attackers to cause arbitrary code execution or application crashes. CInStream::GetCuSize() in the NTFS handler computes the compression-unit buffer size as (UInt32)1 << (BlockSizeLog + CompressionUnit), and a crafted image with ClusterSizeLog >= 28 and CompressionUnit == 4 drives the exponent to 32, which is undefined behavior and collapses on x86/x64 so _inBuf is allocated as 1 byte. ReadStream_FALSE then writes up to 256 MB of attacker-controlled data into that 1-byte buffer in 64 KB iterations, and because the CInStream object sits only 304 bytes after _inBuf, its vtable pointer is overwritten and the next dispatched call achieves a vtable hijack. On 32-bit builds the overflow is unconditionally reached; on 64-bit it requires the parallel 8 GB _outBuf allocation to succeed, otherwise failing closed to denial of service. The NTFS handler is enabled by default in stock 7z.dll and, via signature-based fallback matching "NTFS " at offset 3, will open a crafted image regardless of file extension during extraction or testing. Version 26.01 fixes the issue.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - 7-Zip is a file archiver with a high compression ratio. Versions 26.00 and prior contain a heap buffer
    overflow vulnerability caused by an under-allocation in the NTFS compressed stream buffer (GetCuSize shift
    UB), potentially allowing attackers to cause arbitrary code execution or application crashes.
    CInStream::GetCuSize() in the NTFS handler computes the compression-unit buffer size as (UInt32)1 <<
    (BlockSizeLog + CompressionUnit), and a crafted image with ClusterSizeLog >= 28 and CompressionUnit == 4
    drives the exponent to 32, which is undefined behavior and collapses on x86/x64 so _inBuf is allocated as
    1 byte. ReadStream_FALSE then writes up to 256 MB of attacker-controlled data into that 1-byte buffer in
    64 KB iterations, and because the CInStream object sits only 304 bytes after _inBuf, its vtable pointer is
    overwritten and the next dispatched call achieves a vtable hijack. On 32-bit builds the overflow is
    unconditionally reached; on 64-bit it requires the parallel 8 GB _outBuf allocation to succeed, otherwise
    failing closed to denial of service. The NTFS handler is enabled by default in stock 7z.dll and, via
    signature-based fallback matching "NTFS " at offset 3, will open a crafted image regardless of file
    extension during extraction or testing. Version 26.01 fixes the issue. (CVE-2026-48095)

The version of 7-Zip installed on the remote Windows host is prior to 26.01. It is, therefore, affected by a vulnerability:

  - A heap buffer overflow vulnerability exists in the NTFS archive handler. The CInStream::GetCuSize() function     computes the compression-unit buffer size using a 32-bit shift that reaches undefined behavior when     ClusterSizeLog >= 28 and CompressionUnit == 4, causing _inBuf to be allocated as 1 byte. ReadStream_FALSE     then writes up to 256 MB of attacker-controlled data into this buffer, leading to a vtable hijack and     potential arbitrary code execution. (CVE-2026-48095)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4681 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4681-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Sylvain Beucler     July 13, 2026                                 https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : p7zip     Version        : 16.02+really26.01+dfsg-0+deb11u1     CVE ID         : CVE-2026-48092 CVE-2026-48095 CVE-2026-48101 CVE-2026-48102                      CVE-2026-48103 CVE-2026-48104 CVE-2026-48111 CVE-2026-48112

    Multiple memory corruption vulnerabilities were discovered in p7zip, a     now unmaintained fork of 7-Zip, which itself is a file archiver     handling multiple formats.

    To address these security vulnerabilities, whose fixes are     unfortunately not isolated, this update again replaces p7zip with a     recent 7-Zip (now v26.01), slightly modified to make it reasonably     compatible with p7zip.

    CVE-2026-48092

        SquashFS Fragment Offset Overflow

    CVE-2026-48095

        Heap Buffer Write Overflow

    CVE-2026-48101

        UEFI Capsule uninitialized heap memory disclosure

    CVE-2026-48102

        UDF Field OOB Read

    CVE-2026-48103

        WIM SecurityId OOB read

    CVE-2026-48104

        SquashFS BlockToNode uninitialized heap read

    CVE-2026-48111

        UEFI DEPEX OOB Read

    CVE-2026-48112

        Ar SYMDEF OOB Read

    For Debian 11 bullseye, these problems have been fixed in version     16.02+really26.01+dfsg-0+deb11u1.

    We recommend that you upgrade your p7zip packages.

    For the detailed security status of p7zip please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/p7zip

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2696-1 advisory.

    This update for 7zip fixes the following issues

    Update to 26.01:

    - CVE-2026-48092: Information disclosure in 32-bit builds due to heap memory disclosure (bsc#1267858).
    - CVE-2026-48095: Heap buffer overflow via NTFS compressed stream buffer under-allocation (bsc#1267421).
    - CVE-2026-48101: Information Disclosure via uninitialized memory in UEFI capsule parser (bsc#1267859).
    - CVE-2026-48102: Information disclosure and denial of service via crafted UDF image (bsc#1267860).
    - CVE-2026-48103: off-by-one heap out-of-bounds read (bsc#1267861).
    - CVE-2026-48104: Uninitialized heap read in SquashFS archive handler (bsc#1267862).
    - CVE-2026-48111: off-by-one out-of-bounds read in ParseDepedencyExpression function (bsc#1267863).
    - CVE-2026-48112: heap out-of-bounds read in BSD SYMDEF parser (bsc#1267864).

    Changes:

     * linux version of 7-Zip can use huge pages (2 MB pages). It can      increase compression speed for 10% for 7z/xz/LZMA/LZMA2 compression.
     * new -spo[d|c|r] switch specifies the path generation mode for      the output directory for archive extraction. The output directory      path is generated from the path specified in the -o{dir_path}      switch and the name of the archive being unpacked.
     -spod : for Linux/Posix/macOS: -o{dir_path} specifies the direct      path to the output directory. The asterisk (*) character      in {dir_path} will not be replaced by the archive name.
     -spoc : 7-Zip will concatenate the path specified in -o{dir_path}      with the archive name to form the final path to the output      directory.
     -spor : 7-Zip will replace asterisk (*) character in the path      specified in the -o{dir_path} with the archive name.
     This is the default option.
     * improved code for ZIP, CPIO, RAR, UFD, QCOW, Compound.
     * 7-Zip File Manager: improved sorting order of the file list.
     It uses file name as secondary sorting key.:
     * 7-Zip File Manager: improved Benchmark to support systems with more than      64 CPU threads.
     * bug fixed: 7-Zip could not correctly extract TAR archives containing sparse      files

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f36864b408 advisory.

    - Fixes CVE-2026-48092: Information disclosure in 32-bit builds
    - Fixes CVE-2026-48095: Arbitrary code execution in NTFS handler
    - Fixes CVE-2026-48101: Information disclosure in UEFI capsule parser
    - Fixes CVE-2026-48102: Information disclosure and DOS via crafted UDF       image
    - Fixes CVE-2026-48103: Off-by-one buffer over-read in WIM archive       handler
    - Fixes CVE-2026-48104: Uninitialized heap read in SquashFS archive       handler
    - Fixes CVE-2026-48111: Off-by-one OOB read in UEFI firmware image       parser
    - Fixes CVE-2026-48112: Heap-based buffer over-read in Ar handler BSD       SYMDEF parser


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4be7569210 advisory.

    - Fixes CVE-2026-48092: Information disclosure in 32-bit builds
    - Fixes CVE-2026-48095: Arbitrary code execution in NTFS handler
    - Fixes CVE-2026-48101: Information disclosure in UEFI capsule parser
    - Fixes CVE-2026-48102: Information disclosure and DOS via crafted UDF       image
    - Fixes CVE-2026-48103: Off-by-one buffer over-read in WIM archive       handler
    - Fixes CVE-2026-48104: Uninitialized heap read in SquashFS archive       handler
    - Fixes CVE-2026-48111: Off-by-one OOB read in UEFI firmware image       parser
    - Fixes CVE-2026-48112: Heap-based buffer over-read in Ar handler BSD       SYMDEF parser


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1820 advisory.

    A heap buffer overflow vulnerability (GHSL-2026-140) exists in 7-Zip version 26.00, caused by an under-     allocation in the NTFS compressed stream buffer (GetCuSize shift UB), potentially allowing attackers to     exploit this issue for arbitrary code execution or application crashes. (CVE-2026-48095)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - 7-Zip is a file archiver with a high compression ratio. Versions 26.00 and prior contain a heap buffer     overflow vulnerability caused by an under-allocation in the NTFS compressed stream buffer (GetCuSize shift     UB), potentially allowing attackers to cause arbitrary code execution or application crashes.
    CInStream::GetCuSize() in the NTFS handler computes the compression-unit buffer size as (UInt32)1 <<     (BlockSizeLog + CompressionUnit), and a crafted image with ClusterSizeLog >= 28 and CompressionUnit == 4     drives the exponent to 32, which is undefined behavior and collapses on x86/x64 so _inBuf is allocated as     1 byte. ReadStream_FALSE then writes up to 256 MB of attacker-controlled data into that 1-byte buffer in     64 KB iterations, and because the CInStream object sits only 304 bytes after _inBuf, its vtable pointer is     overwritten and the next dispatched call achieves a vtable hijack. On 32-bit builds the overflow is     unconditionally reached; on 64-bit it requires the parallel 8 GB _outBuf allocation to succeed, otherwise     failing closed to denial of service. The NTFS handler is enabled by default in stock 7z.dll and, via     signature-based fallback matching NTFS  at offset 3, will open a crafted image regardless of file     extension during extraction or testing. Version 26.01 fixes the issue. (CVE-2026-48095)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
459964	Echo: 7zip: security update to 22.01+really26.01+dfsg-0+deb12u1	Tenable Cloud Security	Echo Local Security Checks	Local	high
459964	Echo: 7zip: security update to 22.01+really26.01+dfsg-0+deb12u1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
327608	7-Zip < 26.01 NTFS Heap Buffer Overflow (GHSL-2026-140)	Nessus	Windows	Local	high
326550	Debian dla-4681 : p7zip - security update	Nessus	Debian Local Security Checks	Local	high
324876	SUSE SLED15 / SLES15 Security Update : 7zip (SUSE-SU-2026:2696-1)	Nessus	SuSE Local Security Checks	Local	high
321161	Fedora 43 : 7zip (2026-f36864b408)	Nessus	Fedora Local Security Checks	Local	high
321160	Fedora 44 : 7zip (2026-4be7569210)	Nessus	Fedora Local Security Checks	Local	high
319883	Amazon Linux 2023 : 7zip, 7zip-reduced, 7zip-standalone (ALAS2023-2026-1820)	Nessus	Amazon Linux Local Security Checks	Local	high
317682	Linux Distros Unpatched Vulnerability : CVE-2026-48095	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-48095

high

Tenable Plugins

high

high

high

high

high

high

high

high

high