7-Zip is a file archiver with a high compression ratio. Versions 9.21 through 26.00 contain an An uninitialized memory disclosure vulnerability in the UEFI capsule (.scap) parser in 7-Zip. The OpenCapsule function allocates a heap buffer of attacker-declared CapsuleImageSize (up to 1 GiB) without zero-initialization, then reads the file contents into it with ReadStream_FALSE whose return value is silently discarded. If the file is truncated, the unread tail of the buffer retains uninitialized heap memory, which is then exposed as extracted file content via GetStream. Version 26.0.1 fixes the issue.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f36864b408 advisory.

    - Fixes CVE-2026-48092: Information disclosure in 32-bit builds
    - Fixes CVE-2026-48095: Arbitrary code execution in NTFS handler
    - Fixes CVE-2026-48101: Information disclosure in UEFI capsule parser
    - Fixes CVE-2026-48102: Information disclosure and DOS via crafted UDF       image
    - Fixes CVE-2026-48103: Off-by-one buffer over-read in WIM archive       handler
    - Fixes CVE-2026-48104: Uninitialized heap read in SquashFS archive       handler
    - Fixes CVE-2026-48111: Off-by-one OOB read in UEFI firmware image       parser
    - Fixes CVE-2026-48112: Heap-based buffer over-read in Ar handler BSD       SYMDEF parser


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4be7569210 advisory.

    - Fixes CVE-2026-48092: Information disclosure in 32-bit builds
    - Fixes CVE-2026-48095: Arbitrary code execution in NTFS handler
    - Fixes CVE-2026-48101: Information disclosure in UEFI capsule parser
    - Fixes CVE-2026-48102: Information disclosure and DOS via crafted UDF       image
    - Fixes CVE-2026-48103: Off-by-one buffer over-read in WIM archive       handler
    - Fixes CVE-2026-48104: Uninitialized heap read in SquashFS archive       handler
    - Fixes CVE-2026-48111: Off-by-one OOB read in UEFI firmware image       parser
    - Fixes CVE-2026-48112: Heap-based buffer over-read in Ar handler BSD       SYMDEF parser


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of 7-Zip installed on the remote Windows host is >= 9.21 and prior to 26.01. It is, therefore, affected by multiple vulnerabilities:

  - An uninitialized heap memory disclosure exists in 7-Zip's UEFI Capsule handler, which can lead to     information disclosure or a crash when processing a crafted UEFI Capsule file. (CVE-2026-48101)

  - An out-of-bounds read exists in 7-Zip's UEFI DEPEX handler, which can lead to a crash when processing a     crafted UEFI file. (CVE-2026-48111)

  - A path traversal vulnerability exists in 7-Zip's extraction mode that can lead to arbitrary file write when     extracting a crafted archive. (GHSL-2026-115)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - 7-Zip is a file archiver with a high compression ratio. Versions 9.21 through 26.00 contain an An     uninitialized memory disclosure vulnerability in the UEFI capsule (.scap) parser in 7-Zip. The OpenCapsule     function allocates a heap buffer of attacker-declared CapsuleImageSize (up to 1 GiB) without zero-     initialization, then reads the file contents into it with ReadStream_FALSE whose return value is silently     discarded. If the file is truncated, the unread tail of the buffer retains uninitialized heap memory,     which is then exposed as extracted file content via GetStream. Version 26.0.1 fixes the issue.
    (CVE-2026-48101)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
321161	Fedora 43 : 7zip (2026-f36864b408)	Nessus	Fedora Local Security Checks	high
321160	Fedora 44 : 7zip (2026-4be7569210)	Nessus	Fedora Local Security Checks	high
318786	7-Zip >= 9.21 < 26.01 UEFI Multiple Vulnerabilities (GHSL-2026-115_GHSL-2026-122)	Nessus	Windows	high
317843	Linux Distros Unpatched Vulnerability : CVE-2026-48101	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-48101

medium

Tenable Plugins

high

high

high

medium