7-Zip is a file archiver with a high compression ratio. Versions 26.00 and prior contain a heap buffer overflow vulnerability caused by an under-allocation in the NTFS compressed stream buffer (GetCuSize shift UB), potentially allowing attackers to cause arbitrary code execution or application crashes. CInStream::GetCuSize() in the NTFS handler computes the compression-unit buffer size as (UInt32)1 << (BlockSizeLog + CompressionUnit), and a crafted image with ClusterSizeLog >= 28 and CompressionUnit == 4 drives the exponent to 32, which is undefined behavior and collapses on x86/x64 so _inBuf is allocated as 1 byte. ReadStream_FALSE then writes up to 256 MB of attacker-controlled data into that 1-byte buffer in 64 KB iterations, and because the CInStream object sits only 304 bytes after _inBuf, its vtable pointer is overwritten and the next dispatched call achieves a vtable hijack. On 32-bit builds the overflow is unconditionally reached; on 64-bit it requires the parallel 8 GB _outBuf allocation to succeed, otherwise failing closed to denial of service. The NTFS handler is enabled by default in stock 7z.dll and, via signature-based fallback matching "NTFS " at offset 3, will open a crafted image regardless of file extension during extraction or testing. Version 26.01 fixes the issue.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f36864b408 advisory.

    - Fixes CVE-2026-48092: Information disclosure in 32-bit builds
    - Fixes CVE-2026-48095: Arbitrary code execution in NTFS handler
    - Fixes CVE-2026-48101: Information disclosure in UEFI capsule parser
    - Fixes CVE-2026-48102: Information disclosure and DOS via crafted UDF       image
    - Fixes CVE-2026-48103: Off-by-one buffer over-read in WIM archive       handler
    - Fixes CVE-2026-48104: Uninitialized heap read in SquashFS archive       handler
    - Fixes CVE-2026-48111: Off-by-one OOB read in UEFI firmware image       parser
    - Fixes CVE-2026-48112: Heap-based buffer over-read in Ar handler BSD       SYMDEF parser


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4be7569210 advisory.

    - Fixes CVE-2026-48092: Information disclosure in 32-bit builds
    - Fixes CVE-2026-48095: Arbitrary code execution in NTFS handler
    - Fixes CVE-2026-48101: Information disclosure in UEFI capsule parser
    - Fixes CVE-2026-48102: Information disclosure and DOS via crafted UDF       image
    - Fixes CVE-2026-48103: Off-by-one buffer over-read in WIM archive       handler
    - Fixes CVE-2026-48104: Uninitialized heap read in SquashFS archive       handler
    - Fixes CVE-2026-48111: Off-by-one OOB read in UEFI firmware image       parser
    - Fixes CVE-2026-48112: Heap-based buffer over-read in Ar handler BSD       SYMDEF parser


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1820 advisory.

    A heap buffer overflow vulnerability (GHSL-2026-140) exists in 7-Zip version 26.00, caused by an under-     allocation in the NTFS compressed stream buffer (GetCuSize shift UB), potentially allowing attackers to     exploit this issue for arbitrary code execution or application crashes. (CVE-2026-48095)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - 7-Zip is a file archiver with a high compression ratio. Versions 26.00 and prior contain a heap buffer     overflow vulnerability caused by an under-allocation in the NTFS compressed stream buffer (GetCuSize shift     UB), potentially allowing attackers to cause arbitrary code execution or application crashes.
    CInStream::GetCuSize() in the NTFS handler computes the compression-unit buffer size as (UInt32)1 <<     (BlockSizeLog + CompressionUnit), and a crafted image with ClusterSizeLog >= 28 and CompressionUnit == 4     drives the exponent to 32, which is undefined behavior and collapses on x86/x64 so _inBuf is allocated as     1 byte. ReadStream_FALSE then writes up to 256 MB of attacker-controlled data into that 1-byte buffer in     64 KB iterations, and because the CInStream object sits only 304 bytes after _inBuf, its vtable pointer is     overwritten and the next dispatched call achieves a vtable hijack. On 32-bit builds the overflow is     unconditionally reached; on 64-bit it requires the parallel 8 GB _outBuf allocation to succeed, otherwise     failing closed to denial of service. The NTFS handler is enabled by default in stock 7z.dll and, via     signature-based fallback matching NTFS  at offset 3, will open a crafted image regardless of file     extension during extraction or testing. Version 26.01 fixes the issue. (CVE-2026-48095)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
321161	Fedora 43 : 7zip (2026-f36864b408)	Nessus	Fedora Local Security Checks	high
321160	Fedora 44 : 7zip (2026-4be7569210)	Nessus	Fedora Local Security Checks	high
319883	Amazon Linux 2023 : 7zip, 7zip-reduced, 7zip-standalone (ALAS2023-2026-1820)	Nessus	Amazon Linux Local Security Checks	high
317682	Linux Distros Unpatched Vulnerability : CVE-2026-48095	Nessus	Misc.	high

Detections

Analytics

CVE-2026-48095

high

Tenable Plugins

high

high

high

high