7-Zip is a file archiver with a high compression ratio. Versions 9.21 through 26.00 contain an An uninitialized memory disclosure vulnerability in the UEFI capsule (.scap) parser in 7-Zip. The OpenCapsule function allocates a heap buffer of attacker-declared CapsuleImageSize (up to 1 GiB) without zero-initialization, then reads the file contents into it with ReadStream_FALSE whose return value is silently discarded. If the file is truncated, the unread tail of the buffer retains uninitialized heap memory, which is then exposed as extracted file content via GetStream. Version 26.0.1 fixes the issue.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - 7-Zip is a file archiver with a high compression ratio. Versions 9.21 through 26.00 contain an An
    uninitialized memory disclosure vulnerability in the UEFI capsule (.scap) parser in 7-Zip. The OpenCapsule
    function allocates a heap buffer of attacker-declared CapsuleImageSize (up to 1 GiB) without zero-
    initialization, then reads the file contents into it with ReadStream_FALSE whose return value is silently
    discarded. If the file is truncated, the unread tail of the buffer retains uninitialized heap memory,
    which is then exposed as extracted file content via GetStream. Version 26.0.1 fixes the issue.
    (CVE-2026-48101)

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4681 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4681-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Sylvain Beucler     July 13, 2026                                 https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : p7zip     Version        : 16.02+really26.01+dfsg-0+deb11u1     CVE ID         : CVE-2026-48092 CVE-2026-48095 CVE-2026-48101 CVE-2026-48102                      CVE-2026-48103 CVE-2026-48104 CVE-2026-48111 CVE-2026-48112

    Multiple memory corruption vulnerabilities were discovered in p7zip, a     now unmaintained fork of 7-Zip, which itself is a file archiver     handling multiple formats.

    To address these security vulnerabilities, whose fixes are     unfortunately not isolated, this update again replaces p7zip with a     recent 7-Zip (now v26.01), slightly modified to make it reasonably     compatible with p7zip.

    CVE-2026-48092

        SquashFS Fragment Offset Overflow

    CVE-2026-48095

        Heap Buffer Write Overflow

    CVE-2026-48101

        UEFI Capsule uninitialized heap memory disclosure

    CVE-2026-48102

        UDF Field OOB Read

    CVE-2026-48103

        WIM SecurityId OOB read

    CVE-2026-48104

        SquashFS BlockToNode uninitialized heap read

    CVE-2026-48111

        UEFI DEPEX OOB Read

    CVE-2026-48112

        Ar SYMDEF OOB Read

    For Debian 11 bullseye, these problems have been fixed in version     16.02+really26.01+dfsg-0+deb11u1.

    We recommend that you upgrade your p7zip packages.

    For the detailed security status of p7zip please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/p7zip

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2696-1 advisory.

    This update for 7zip fixes the following issues

    Update to 26.01:

    - CVE-2026-48092: Information disclosure in 32-bit builds due to heap memory disclosure (bsc#1267858).
    - CVE-2026-48095: Heap buffer overflow via NTFS compressed stream buffer under-allocation (bsc#1267421).
    - CVE-2026-48101: Information Disclosure via uninitialized memory in UEFI capsule parser (bsc#1267859).
    - CVE-2026-48102: Information disclosure and denial of service via crafted UDF image (bsc#1267860).
    - CVE-2026-48103: off-by-one heap out-of-bounds read (bsc#1267861).
    - CVE-2026-48104: Uninitialized heap read in SquashFS archive handler (bsc#1267862).
    - CVE-2026-48111: off-by-one out-of-bounds read in ParseDepedencyExpression function (bsc#1267863).
    - CVE-2026-48112: heap out-of-bounds read in BSD SYMDEF parser (bsc#1267864).

    Changes:

     * linux version of 7-Zip can use huge pages (2 MB pages). It can      increase compression speed for 10% for 7z/xz/LZMA/LZMA2 compression.
     * new -spo[d|c|r] switch specifies the path generation mode for      the output directory for archive extraction. The output directory      path is generated from the path specified in the -o{dir_path}      switch and the name of the archive being unpacked.
     -spod : for Linux/Posix/macOS: -o{dir_path} specifies the direct      path to the output directory. The asterisk (*) character      in {dir_path} will not be replaced by the archive name.
     -spoc : 7-Zip will concatenate the path specified in -o{dir_path}      with the archive name to form the final path to the output      directory.
     -spor : 7-Zip will replace asterisk (*) character in the path      specified in the -o{dir_path} with the archive name.
     This is the default option.
     * improved code for ZIP, CPIO, RAR, UFD, QCOW, Compound.
     * 7-Zip File Manager: improved sorting order of the file list.
     It uses file name as secondary sorting key.:
     * 7-Zip File Manager: improved Benchmark to support systems with more than      64 CPU threads.
     * bug fixed: 7-Zip could not correctly extract TAR archives containing sparse      files

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f36864b408 advisory.

    - Fixes CVE-2026-48092: Information disclosure in 32-bit builds
    - Fixes CVE-2026-48095: Arbitrary code execution in NTFS handler
    - Fixes CVE-2026-48101: Information disclosure in UEFI capsule parser
    - Fixes CVE-2026-48102: Information disclosure and DOS via crafted UDF       image
    - Fixes CVE-2026-48103: Off-by-one buffer over-read in WIM archive       handler
    - Fixes CVE-2026-48104: Uninitialized heap read in SquashFS archive       handler
    - Fixes CVE-2026-48111: Off-by-one OOB read in UEFI firmware image       parser
    - Fixes CVE-2026-48112: Heap-based buffer over-read in Ar handler BSD       SYMDEF parser


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4be7569210 advisory.

    - Fixes CVE-2026-48092: Information disclosure in 32-bit builds
    - Fixes CVE-2026-48095: Arbitrary code execution in NTFS handler
    - Fixes CVE-2026-48101: Information disclosure in UEFI capsule parser
    - Fixes CVE-2026-48102: Information disclosure and DOS via crafted UDF       image
    - Fixes CVE-2026-48103: Off-by-one buffer over-read in WIM archive       handler
    - Fixes CVE-2026-48104: Uninitialized heap read in SquashFS archive       handler
    - Fixes CVE-2026-48111: Off-by-one OOB read in UEFI firmware image       parser
    - Fixes CVE-2026-48112: Heap-based buffer over-read in Ar handler BSD       SYMDEF parser


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of 7-Zip installed on the remote Windows host is >= 9.21 and prior to 26.01. It is, therefore, affected by multiple vulnerabilities:

  - An uninitialized heap memory disclosure exists in 7-Zip's UEFI Capsule handler, which can lead to     information disclosure or a crash when processing a crafted UEFI Capsule file. (CVE-2026-48101)

  - An out-of-bounds read exists in 7-Zip's UEFI DEPEX handler, which can lead to a crash when processing a     crafted UEFI file. (CVE-2026-48111)

  - A path traversal vulnerability exists in 7-Zip's extraction mode that can lead to arbitrary file write when     extracting a crafted archive. (GHSL-2026-115)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - 7-Zip is a file archiver with a high compression ratio. Versions 9.21 through 26.00 contain an An     uninitialized memory disclosure vulnerability in the UEFI capsule (.scap) parser in 7-Zip. The OpenCapsule     function allocates a heap buffer of attacker-declared CapsuleImageSize (up to 1 GiB) without zero-     initialization, then reads the file contents into it with ReadStream_FALSE whose return value is silently     discarded. If the file is truncated, the unread tail of the buffer retains uninitialized heap memory,     which is then exposed as extracted file content via GetStream. Version 26.0.1 fixes the issue.
    (CVE-2026-48101)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
457466	Echo: 7zip: security update to 22.01+really26.01+dfsg-0+deb12u1	Tenable Cloud Security	Echo Local Security Checks	Local	medium
457466	Echo: 7zip: security update to 22.01+really26.01+dfsg-0+deb12u1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
326550	Debian dla-4681 : p7zip - security update	Nessus	Debian Local Security Checks	Local	high
324876	SUSE SLED15 / SLES15 Security Update : 7zip (SUSE-SU-2026:2696-1)	Nessus	SuSE Local Security Checks	Local	high
321161	Fedora 43 : 7zip (2026-f36864b408)	Nessus	Fedora Local Security Checks	Local	high
321160	Fedora 44 : 7zip (2026-4be7569210)	Nessus	Fedora Local Security Checks	Local	high
318786	7-Zip >= 9.21 < 26.01 UEFI Multiple Vulnerabilities (GHSL-2026-115_GHSL-2026-122)	Nessus	Windows	Local	high
317843	Linux Distros Unpatched Vulnerability : CVE-2026-48101	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-48101

medium

Tenable Plugins

medium

medium

high

high

high

high

high

medium