7-Zip is a file archiver with a high compression ratio. Versions 9.21 through 26.00 contain an off-by-one out-of-bounds read vulnerability in the ParseDepedencyExpression function of the UEFI firmware image parser(CPP/7zip/Archive/UefiHandler.cpp). The function validates an attacker-controlled opcode byte using > instead of >= against the element count of the 10-entry kExpressionCommands static array, allowing an opcode value of 10 to read one pointer slot (8 bytes on x64) past the end of the array in .rodata. The out-of-bounds value is then dereferenced as a const char * and passed through strlen and memcpy into the archive's Characts property, which may cause either a denial of service (access violation when the adjacent bytes do not form a valid readable pointer) or a minor information disclosure of an adjacent .rdata string literal into archive metadata. The vulnerability is reached automatically during IInArchive::Open() via the call path OpenFv/OpenCapsule → ParseVolume → ParseSections when processing a SECTION_DXE_DEPEX (0x13) or SECTION_PEI_DEPEX (0x1B) section whose first body byte is 0x0A, and the UEFI handler is enabled by default in stock 7z.dll with signature-based detection for both UEFIc and UEFIf formats. The outcome (crash vs. silent leak) is deterministic per build but linker-layout dependent, with no write primitive and no disclosure of heap data, secrets, or ASLR base addresses. Version 26.01 fixes the issue.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4681 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4681-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Sylvain Beucler     July 13, 2026                                 https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : p7zip     Version        : 16.02+really26.01+dfsg-0+deb11u1     CVE ID         : CVE-2026-48092 CVE-2026-48095 CVE-2026-48101 CVE-2026-48102                      CVE-2026-48103 CVE-2026-48104 CVE-2026-48111 CVE-2026-48112

    Multiple memory corruption vulnerabilities were discovered in p7zip, a     now unmaintained fork of 7-Zip, which itself is a file archiver     handling multiple formats.

    To address these security vulnerabilities, whose fixes are     unfortunately not isolated, this update again replaces p7zip with a     recent 7-Zip (now v26.01), slightly modified to make it reasonably     compatible with p7zip.

    CVE-2026-48092

        SquashFS Fragment Offset Overflow

    CVE-2026-48095

        Heap Buffer Write Overflow

    CVE-2026-48101

        UEFI Capsule uninitialized heap memory disclosure

    CVE-2026-48102

        UDF Field OOB Read

    CVE-2026-48103

        WIM SecurityId OOB read

    CVE-2026-48104

        SquashFS BlockToNode uninitialized heap read

    CVE-2026-48111

        UEFI DEPEX OOB Read

    CVE-2026-48112

        Ar SYMDEF OOB Read

    For Debian 11 bullseye, these problems have been fixed in version     16.02+really26.01+dfsg-0+deb11u1.

    We recommend that you upgrade your p7zip packages.

    For the detailed security status of p7zip please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/p7zip

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2696-1 advisory.

    This update for 7zip fixes the following issues

    Update to 26.01:

    - CVE-2026-48092: Information disclosure in 32-bit builds due to heap memory disclosure (bsc#1267858).
    - CVE-2026-48095: Heap buffer overflow via NTFS compressed stream buffer under-allocation (bsc#1267421).
    - CVE-2026-48101: Information Disclosure via uninitialized memory in UEFI capsule parser (bsc#1267859).
    - CVE-2026-48102: Information disclosure and denial of service via crafted UDF image (bsc#1267860).
    - CVE-2026-48103: off-by-one heap out-of-bounds read (bsc#1267861).
    - CVE-2026-48104: Uninitialized heap read in SquashFS archive handler (bsc#1267862).
    - CVE-2026-48111: off-by-one out-of-bounds read in ParseDepedencyExpression function (bsc#1267863).
    - CVE-2026-48112: heap out-of-bounds read in BSD SYMDEF parser (bsc#1267864).

    Changes:

     * linux version of 7-Zip can use huge pages (2 MB pages). It can      increase compression speed for 10% for 7z/xz/LZMA/LZMA2 compression.
     * new -spo[d|c|r] switch specifies the path generation mode for      the output directory for archive extraction. The output directory      path is generated from the path specified in the -o{dir_path}      switch and the name of the archive being unpacked.
     -spod : for Linux/Posix/macOS: -o{dir_path} specifies the direct      path to the output directory. The asterisk (*) character      in {dir_path} will not be replaced by the archive name.
     -spoc : 7-Zip will concatenate the path specified in -o{dir_path}      with the archive name to form the final path to the output      directory.
     -spor : 7-Zip will replace asterisk (*) character in the path      specified in the -o{dir_path} with the archive name.
     This is the default option.
     * improved code for ZIP, CPIO, RAR, UFD, QCOW, Compound.
     * 7-Zip File Manager: improved sorting order of the file list.
     It uses file name as secondary sorting key.:
     * 7-Zip File Manager: improved Benchmark to support systems with more than      64 CPU threads.
     * bug fixed: 7-Zip could not correctly extract TAR archives containing sparse      files

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f36864b408 advisory.

    - Fixes CVE-2026-48092: Information disclosure in 32-bit builds
    - Fixes CVE-2026-48095: Arbitrary code execution in NTFS handler
    - Fixes CVE-2026-48101: Information disclosure in UEFI capsule parser
    - Fixes CVE-2026-48102: Information disclosure and DOS via crafted UDF       image
    - Fixes CVE-2026-48103: Off-by-one buffer over-read in WIM archive       handler
    - Fixes CVE-2026-48104: Uninitialized heap read in SquashFS archive       handler
    - Fixes CVE-2026-48111: Off-by-one OOB read in UEFI firmware image       parser
    - Fixes CVE-2026-48112: Heap-based buffer over-read in Ar handler BSD       SYMDEF parser


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4be7569210 advisory.

    - Fixes CVE-2026-48092: Information disclosure in 32-bit builds
    - Fixes CVE-2026-48095: Arbitrary code execution in NTFS handler
    - Fixes CVE-2026-48101: Information disclosure in UEFI capsule parser
    - Fixes CVE-2026-48102: Information disclosure and DOS via crafted UDF       image
    - Fixes CVE-2026-48103: Off-by-one buffer over-read in WIM archive       handler
    - Fixes CVE-2026-48104: Uninitialized heap read in SquashFS archive       handler
    - Fixes CVE-2026-48111: Off-by-one OOB read in UEFI firmware image       parser
    - Fixes CVE-2026-48112: Heap-based buffer over-read in Ar handler BSD       SYMDEF parser


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of 7-Zip installed on the remote Windows host is >= 9.21 and prior to 26.01. It is, therefore, affected by multiple vulnerabilities:

  - An uninitialized heap memory disclosure exists in 7-Zip's UEFI Capsule handler, which can lead to     information disclosure or a crash when processing a crafted UEFI Capsule file. (CVE-2026-48101)

  - An out-of-bounds read exists in 7-Zip's UEFI DEPEX handler, which can lead to a crash when processing a     crafted UEFI file. (CVE-2026-48111)

  - A path traversal vulnerability exists in 7-Zip's extraction mode that can lead to arbitrary file write when     extracting a crafted archive. (GHSL-2026-115)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - 7-Zip is a file archiver with a high compression ratio. Versions 9.21 through 26.00 contain an off-by-one     out-of-bounds read vulnerability in the ParseDepedencyExpression function of the UEFI firmware image     parser(CPP/7zip/Archive/UefiHandler.cpp). The function validates an attacker-controlled opcode byte using     > instead of >= against the element count of the 10-entry kExpressionCommands static array, allowing an     opcode value of 10 to read one pointer slot (8 bytes on x64) past the end of the array in .rodata. The     out-of-bounds value is then dereferenced as a const char * and passed through strlen and memcpy into the     archive's Characts property, which may cause either a denial of service (access violation when the     adjacent bytes do not form a valid readable pointer) or a minor information disclosure of an adjacent     .rdata string literal into archive metadata. The vulnerability is reached automatically during     IInArchive::Open() via the call path OpenFv/OpenCapsule  ParseVolume  ParseSections when processing a     SECTION_DXE_DEPEX (0x13) or SECTION_PEI_DEPEX (0x1B) section whose first body byte is 0x0A, and the UEFI     handler is enabled by default in stock 7z.dll with signature-based detection for both UEFIc and UEFIf     formats. The outcome (crash vs. silent leak) is deterministic per build but linker-layout dependent, with     no write primitive and no disclosure of heap data, secrets, or ASLR base addresses. Version 26.01 fixes     the issue. (CVE-2026-48111)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
326550	Debian dla-4681 : p7zip - security update	Nessus	Debian Local Security Checks	Local	high
324876	SUSE SLED15 / SLES15 Security Update : 7zip (SUSE-SU-2026:2696-1)	Nessus	SuSE Local Security Checks	Local	high
321161	Fedora 43 : 7zip (2026-f36864b408)	Nessus	Fedora Local Security Checks	Local	high
321160	Fedora 44 : 7zip (2026-4be7569210)	Nessus	Fedora Local Security Checks	Local	high
318786	7-Zip >= 9.21 < 26.01 UEFI Multiple Vulnerabilities (GHSL-2026-115_GHSL-2026-122)	Nessus	Windows	Local	high
317852	Linux Distros Unpatched Vulnerability : CVE-2026-48111	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-48111

high

Tenable Plugins

high

high

high

high

high

high