7-Zip is a file archiver with a high compression ratio. Versions 9.34 through 26.00 contain an off-by-one heap out-of-bounds read in the WIM (Windows Imaging) archive handler's security descriptor lookup. In CHandler::GetSecurity (CPP/7zip/Archive/Wim/WimHandler.cpp), the per-image SecurOffsets table holds numEntries + 1 cumulative offsets, but the check securityId >= SecurOffsets.Size() admits securityId == numEntries, and the function then reads SecurOffsets[securityId + 1], fetching one UInt32 past the end of the heap-allocated CRecordVector (which performs no bounds checking on operator[]). The securityId is attacker-controlled at offset +0xC of any directory entry in WIM metadata, and the handler is registered for .wim, .swm, .esd, and .ppkg and enabled by default in stock 7z.dll; the OOB triggers zero-click in the GUI because 7zFM.exe's ListView calls GetRawProp(kpidNtSecure) for every item during listing (ASan-confirmed), and is also reachable via CLI listing with 7zz l -slt. Impact is limited to denial of service under hardened allocators and minor information disclosure, since the OOB value is only consumed arithmetically as a length and is not surfaced to the attacker; there is no write primitive.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f36864b408 advisory.

    - Fixes CVE-2026-48092: Information disclosure in 32-bit builds
    - Fixes CVE-2026-48095: Arbitrary code execution in NTFS handler
    - Fixes CVE-2026-48101: Information disclosure in UEFI capsule parser
    - Fixes CVE-2026-48102: Information disclosure and DOS via crafted UDF       image
    - Fixes CVE-2026-48103: Off-by-one buffer over-read in WIM archive       handler
    - Fixes CVE-2026-48104: Uninitialized heap read in SquashFS archive       handler
    - Fixes CVE-2026-48111: Off-by-one OOB read in UEFI firmware image       parser
    - Fixes CVE-2026-48112: Heap-based buffer over-read in Ar handler BSD       SYMDEF parser


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4be7569210 advisory.

    - Fixes CVE-2026-48092: Information disclosure in 32-bit builds
    - Fixes CVE-2026-48095: Arbitrary code execution in NTFS handler
    - Fixes CVE-2026-48101: Information disclosure in UEFI capsule parser
    - Fixes CVE-2026-48102: Information disclosure and DOS via crafted UDF       image
    - Fixes CVE-2026-48103: Off-by-one buffer over-read in WIM archive       handler
    - Fixes CVE-2026-48104: Uninitialized heap read in SquashFS archive       handler
    - Fixes CVE-2026-48111: Off-by-one OOB read in UEFI firmware image       parser
    - Fixes CVE-2026-48112: Heap-based buffer over-read in Ar handler BSD       SYMDEF parser


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of 7-Zip installed on the remote Windows host is >= 9.34 and prior to 26.01. It is, therefore, affected by multiple vulnerabilities:

  - An out-of-bounds read exists in 7-Zip's WIM SecurityId handling, which can lead to a crash when processing     a crafted WIM image. (CVE-2026-48103)

  - An out-of-bounds read exists in 7-Zip's Ar/BSD SYMDEF parser due to a four-byte OOB read when parsing BSD     symbol tables at a buffer boundary, which can lead to a crash when processing a crafted archive.
    (CVE-2026-48112)

  - A path traversal vulnerability exists in 7-Zip's extraction mode that can lead to arbitrary file write when     extracting a crafted archive. (GHSL-2026-115)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - 7-Zip is a file archiver with a high compression ratio. Versions 9.34 through 26.00 contain an off-by-one     heap out-of-bounds read in the WIM (Windows Imaging) archive handler's security descriptor lookup. In     CHandler::GetSecurity (CPP/7zip/Archive/Wim/WimHandler.cpp), the per-image SecurOffsets table holds     numEntries + 1 cumulative offsets, but the check securityId >= SecurOffsets.Size() admits securityId ==     numEntries, and the function then reads SecurOffsets[securityId + 1], fetching one UInt32 past the end of     the heap-allocated CRecordVector (which performs no bounds checking on operator[]). The securityId is     attacker-controlled at offset +0xC of any directory entry in WIM metadata, and the handler is registered     for .wim, .swm, .esd, and .ppkg and enabled by default in stock 7z.dll; the OOB triggers zero-click in the     GUI because 7zFM.exe's ListView calls GetRawProp(kpidNtSecure) for every item during listing (ASan-     confirmed), and is also reachable via CLI listing with 7zz l -slt. Impact is limited to denial of service     under hardened allocators and minor information disclosure, since the OOB value is only consumed     arithmetically as a length and is not surfaced to the attacker; there is no write primitive.
    (CVE-2026-48103)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
321161	Fedora 43 : 7zip (2026-f36864b408)	Nessus	Fedora Local Security Checks	high
321160	Fedora 44 : 7zip (2026-4be7569210)	Nessus	Fedora Local Security Checks	high
318790	7-Zip >= 9.34 < 26.01 WIM / Ar SYMDEF OOB Read (GHSL-2026-115_GHSL-2026-122)	Nessus	Windows	high
317912	Linux Distros Unpatched Vulnerability : CVE-2026-48103	Nessus	Misc.	high

Detections

Analytics

CVE-2026-48103

high

Tenable Plugins

high

high

high

high