7-Zip is a file archiver with a high compression ratio. Versions 9.34 through 26.00 contain an off-by-one heap out-of-bounds read in the WIM (Windows Imaging) archive handler's security descriptor lookup. In CHandler::GetSecurity (CPP/7zip/Archive/Wim/WimHandler.cpp), the per-image SecurOffsets table holds numEntries + 1 cumulative offsets, but the check securityId >= SecurOffsets.Size() admits securityId == numEntries, and the function then reads SecurOffsets[securityId + 1], fetching one UInt32 past the end of the heap-allocated CRecordVector (which performs no bounds checking on operator[]). The securityId is attacker-controlled at offset +0xC of any directory entry in WIM metadata, and the handler is registered for .wim, .swm, .esd, and .ppkg and enabled by default in stock 7z.dll; the OOB triggers zero-click in the GUI because 7zFM.exe's ListView calls GetRawProp(kpidNtSecure) for every item during listing (ASan-confirmed), and is also reachable via CLI listing with 7zz l -slt. Impact is limited to denial of service under hardened allocators and minor information disclosure, since the OOB value is only consumed arithmetically as a length and is not surfaced to the attacker; there is no write primitive.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4681 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4681-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Sylvain Beucler     July 13, 2026                                 https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : p7zip     Version        : 16.02+really26.01+dfsg-0+deb11u1     CVE ID         : CVE-2026-48092 CVE-2026-48095 CVE-2026-48101 CVE-2026-48102                      CVE-2026-48103 CVE-2026-48104 CVE-2026-48111 CVE-2026-48112

    Multiple memory corruption vulnerabilities were discovered in p7zip, a     now unmaintained fork of 7-Zip, which itself is a file archiver     handling multiple formats.

    To address these security vulnerabilities, whose fixes are     unfortunately not isolated, this update again replaces p7zip with a     recent 7-Zip (now v26.01), slightly modified to make it reasonably     compatible with p7zip.

    CVE-2026-48092

        SquashFS Fragment Offset Overflow

    CVE-2026-48095

        Heap Buffer Write Overflow

    CVE-2026-48101

        UEFI Capsule uninitialized heap memory disclosure

    CVE-2026-48102

        UDF Field OOB Read

    CVE-2026-48103

        WIM SecurityId OOB read

    CVE-2026-48104

        SquashFS BlockToNode uninitialized heap read

    CVE-2026-48111

        UEFI DEPEX OOB Read

    CVE-2026-48112

        Ar SYMDEF OOB Read

    For Debian 11 bullseye, these problems have been fixed in version     16.02+really26.01+dfsg-0+deb11u1.

    We recommend that you upgrade your p7zip packages.

    For the detailed security status of p7zip please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/p7zip

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2696-1 advisory.

    This update for 7zip fixes the following issues

    Update to 26.01:

    - CVE-2026-48092: Information disclosure in 32-bit builds due to heap memory disclosure (bsc#1267858).
    - CVE-2026-48095: Heap buffer overflow via NTFS compressed stream buffer under-allocation (bsc#1267421).
    - CVE-2026-48101: Information Disclosure via uninitialized memory in UEFI capsule parser (bsc#1267859).
    - CVE-2026-48102: Information disclosure and denial of service via crafted UDF image (bsc#1267860).
    - CVE-2026-48103: off-by-one heap out-of-bounds read (bsc#1267861).
    - CVE-2026-48104: Uninitialized heap read in SquashFS archive handler (bsc#1267862).
    - CVE-2026-48111: off-by-one out-of-bounds read in ParseDepedencyExpression function (bsc#1267863).
    - CVE-2026-48112: heap out-of-bounds read in BSD SYMDEF parser (bsc#1267864).

    Changes:

     * linux version of 7-Zip can use huge pages (2 MB pages). It can      increase compression speed for 10% for 7z/xz/LZMA/LZMA2 compression.
     * new -spo[d|c|r] switch specifies the path generation mode for      the output directory for archive extraction. The output directory      path is generated from the path specified in the -o{dir_path}      switch and the name of the archive being unpacked.
     -spod : for Linux/Posix/macOS: -o{dir_path} specifies the direct      path to the output directory. The asterisk (*) character      in {dir_path} will not be replaced by the archive name.
     -spoc : 7-Zip will concatenate the path specified in -o{dir_path}      with the archive name to form the final path to the output      directory.
     -spor : 7-Zip will replace asterisk (*) character in the path      specified in the -o{dir_path} with the archive name.
     This is the default option.
     * improved code for ZIP, CPIO, RAR, UFD, QCOW, Compound.
     * 7-Zip File Manager: improved sorting order of the file list.
     It uses file name as secondary sorting key.:
     * 7-Zip File Manager: improved Benchmark to support systems with more than      64 CPU threads.
     * bug fixed: 7-Zip could not correctly extract TAR archives containing sparse      files

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f36864b408 advisory.

    - Fixes CVE-2026-48092: Information disclosure in 32-bit builds
    - Fixes CVE-2026-48095: Arbitrary code execution in NTFS handler
    - Fixes CVE-2026-48101: Information disclosure in UEFI capsule parser
    - Fixes CVE-2026-48102: Information disclosure and DOS via crafted UDF       image
    - Fixes CVE-2026-48103: Off-by-one buffer over-read in WIM archive       handler
    - Fixes CVE-2026-48104: Uninitialized heap read in SquashFS archive       handler
    - Fixes CVE-2026-48111: Off-by-one OOB read in UEFI firmware image       parser
    - Fixes CVE-2026-48112: Heap-based buffer over-read in Ar handler BSD       SYMDEF parser


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4be7569210 advisory.

    - Fixes CVE-2026-48092: Information disclosure in 32-bit builds
    - Fixes CVE-2026-48095: Arbitrary code execution in NTFS handler
    - Fixes CVE-2026-48101: Information disclosure in UEFI capsule parser
    - Fixes CVE-2026-48102: Information disclosure and DOS via crafted UDF       image
    - Fixes CVE-2026-48103: Off-by-one buffer over-read in WIM archive       handler
    - Fixes CVE-2026-48104: Uninitialized heap read in SquashFS archive       handler
    - Fixes CVE-2026-48111: Off-by-one OOB read in UEFI firmware image       parser
    - Fixes CVE-2026-48112: Heap-based buffer over-read in Ar handler BSD       SYMDEF parser


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of 7-Zip installed on the remote Windows host is >= 9.34 and prior to 26.01. It is, therefore, affected by multiple vulnerabilities:

  - An out-of-bounds read exists in 7-Zip's WIM SecurityId handling, which can lead to a crash when processing     a crafted WIM image. (CVE-2026-48103)

  - An out-of-bounds read exists in 7-Zip's Ar/BSD SYMDEF parser due to a four-byte OOB read when parsing BSD     symbol tables at a buffer boundary, which can lead to a crash when processing a crafted archive.
    (CVE-2026-48112)

  - A path traversal vulnerability exists in 7-Zip's extraction mode that can lead to arbitrary file write when     extracting a crafted archive. (GHSL-2026-115)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - 7-Zip is a file archiver with a high compression ratio. Versions 9.34 through 26.00 contain an off-by-one     heap out-of-bounds read in the WIM (Windows Imaging) archive handler's security descriptor lookup. In     CHandler::GetSecurity (CPP/7zip/Archive/Wim/WimHandler.cpp), the per-image SecurOffsets table holds     numEntries + 1 cumulative offsets, but the check securityId >= SecurOffsets.Size() admits securityId ==     numEntries, and the function then reads SecurOffsets[securityId + 1], fetching one UInt32 past the end of     the heap-allocated CRecordVector (which performs no bounds checking on operator[]). The securityId is     attacker-controlled at offset +0xC of any directory entry in WIM metadata, and the handler is registered     for .wim, .swm, .esd, and .ppkg and enabled by default in stock 7z.dll; the OOB triggers zero-click in the     GUI because 7zFM.exe's ListView calls GetRawProp(kpidNtSecure) for every item during listing (ASan-     confirmed), and is also reachable via CLI listing with 7zz l -slt. Impact is limited to denial of service     under hardened allocators and minor information disclosure, since the OOB value is only consumed     arithmetically as a length and is not surfaced to the attacker; there is no write primitive.
    (CVE-2026-48103)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
326550	Debian dla-4681 : p7zip - security update	Nessus	Debian Local Security Checks	Local	high
324876	SUSE SLED15 / SLES15 Security Update : 7zip (SUSE-SU-2026:2696-1)	Nessus	SuSE Local Security Checks	Local	high
321161	Fedora 43 : 7zip (2026-f36864b408)	Nessus	Fedora Local Security Checks	Local	high
321160	Fedora 44 : 7zip (2026-4be7569210)	Nessus	Fedora Local Security Checks	Local	high
318790	7-Zip >= 9.34 < 26.01 WIM / Ar SYMDEF OOB Read (GHSL-2026-115_GHSL-2026-122)	Nessus	Windows	Local	high
317912	Linux Distros Unpatched Vulnerability : CVE-2026-48103	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-48103

high

Tenable Plugins

high

high

high

high

high

high