Detections
Analytics

Echo: 7zip: security update to 22.01+really26.01+dfsg-0+deb12u1

high Tenable Self-Hosted Container Security Plugin ID 459964

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - 7-Zip is a file archiver with a high compression ratio. Versions 26.00 and prior contain a heap buffer
 overflow vulnerability caused by an under-allocation in the NTFS compressed stream buffer (GetCuSize shift
 UB), potentially allowing attackers to cause arbitrary code execution or application crashes.
 CInStream::GetCuSize() in the NTFS handler computes the compression-unit buffer size as (UInt32)1 <<
 (BlockSizeLog + CompressionUnit), and a crafted image with ClusterSizeLog >= 28 and CompressionUnit == 4
 drives the exponent to 32, which is undefined behavior and collapses on x86/x64 so _inBuf is allocated as
 1 byte. ReadStream_FALSE then writes up to 256 MB of attacker-controlled data into that 1-byte buffer in
 64 KB iterations, and because the CInStream object sits only 304 bytes after _inBuf, its vtable pointer is
 overwritten and the next dispatched call achieves a vtable hijack. On 32-bit builds the overflow is
 unconditionally reached; on 64-bit it requires the parallel 8 GB _outBuf allocation to succeed, otherwise
 failing closed to denial of service. The NTFS handler is enabled by default in stock 7z.dll and, via
 signature-based fallback matching "NTFS " at offset 3, will open a crafted image regardless of file
 extension during extraction or testing. Version 26.01 fixes the issue. (CVE-2026-48095)

Solution

Update the 7zip library and its related packages to version 22.01+really26.01+dfsg-0+deb12u1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-48095

Plugin Details

Severity: High

ID: 459964

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: High

Score: 7.9

Percentile: 99.35

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-48095

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 7/6/2026

Vulnerability Publication Date: 6/4/2026

Reference Information

CVE: CVE-2026-48095

IAVA: 2026-A-0525