CVE-2026-48101: 7-Zip UEFI Capsule Memory Disclosure Vulnerability

Technical summary

The vulnerability exists in the OpenCapsule function within 7-Zip's UEFI capsule (.scap) parser. The function allocates a heap buffer up to 1 GiB in size based on an attacker-supplied CapsuleImageSize field, but does not initialize the memory to zero. The function then calls ReadStream_FALSE to populate this buffer with file contents; however, the return value—which indicates how many bytes were actually read—is discarded without checking. If a malicious or truncated .scap file provides fewer bytes than the declared capsule size, the trailing portion of the heap buffer remains uninitialized. When the parser later retrieves the buffer contents via GetStream, this uninitialized heap memory is exposed as part of the extracted file data. The memory may contain fragments of previously freed objects, stack data, or other sensitive heap allocations from the same process. This is classified as an uninitialized memory disclosure (CWE-908) with a CVSS 3.1 score of 6.5 (MEDIUM severity).

Business impact

The primary risk is information disclosure: an attacker can craft a malicious .scap file that, when extracted by a victim using a vulnerable 7-Zip version, causes heap memory to be leaked as file output. This memory may contain cryptographic keys, credentials, or other sensitive data resident in the process. For organizations that process firmware update capsules or handle untrusted archive content, this could facilitate credential theft or system compromise planning. End-user risk is lower if 7-Zip is used only with trusted archives, but the ease of exploitation and lack of user authentication requirements (CVSS AV:N, PR:N, UI:R) means wide deployment of vulnerable versions could enable opportunistic attacks. The MEDIUM severity reflects the confidentiality impact without direct code execution or availability loss.

Affected systems

7-Zip versions 9.21 through 26.00 are affected. The vulnerability resides specifically in the UEFI capsule (.scap) parser, so impact is limited to users or systems that extract .scap files. Version 26.0.1 and later versions after the fix eliminate the vulnerability. Organizations should verify their deployed 7-Zip version and check whether their workflows involve processing capsule files, particularly those from untrusted or external sources.

Exploitability

The vulnerability requires user interaction (UI:R)—a user must actively extract or open a malicious .scap file. However, the barrier to exploitation is low: an attacker simply crafts a truncated or undersized capsule file and distributes it via email, web download, or file sharing. No special privileges are required, and the attack is network-accessible. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) indicates straightforward exploitation once a user processes the file. This is not listed in CISA's Known Exploited Vulnerabilities catalog, but the technical simplicity and public disclosure mean exploitation tools could emerge quickly.

Remediation

Upgrade to 7-Zip version 26.0.1 or later. Users and administrators should prioritize patching all deployed 7-Zip instances, especially on endpoints that handle archive files from external or untrusted sources. For organizations with restricted update timelines, consider disabling or removing 7-Zip from systems that do not require it, or restricting its use to trusted archives only. Until patched, assume that any .scap file processed by a vulnerable version may have caused information disclosure; treat any extracted content as potentially contaminated if the source is untrusted.

Patch guidance

Apply 7-Zip version 26.0.1 or a later patch release. Verify the version via the 7-Zip About dialog (Help > About) or by checking the executable version properties. After upgrade, perform a test extraction of a known .scap file to confirm normal operation. For enterprise deployments, coordinate patching through standard change management and test in a staging environment first. The fix is confirmed as addressing CWE-908 uninitialized memory, so version 26.0.1 will properly zero-initialize the heap buffer and validate ReadStream return values.

Detection guidance

Detection is challenging because the vulnerability produces no error messages or obvious failure modes—uninitialized memory is silently leaked. Monitor for unusual 7-Zip usage patterns, particularly extraction of .scap files from external sources. Endpoint telemetry should flag 7-Zip versions below 26.0.1 for priority patching. If memory forensics are available post-incident, examine heap dumps for fragments of sensitive data appearing in extracted file outputs. Network-level detection is difficult unless you can inspect archive traffic; focus detection efforts on the host-level inventory and version baseline.

Why prioritize this

Although severity is MEDIUM, prioritization depends on your organization's exposure. If your environment processes UEFI firmware updates, vendor-supplied capsules, or handles untrusted archives, this should be patched promptly because information disclosure could facilitate lateral movement or credential theft in a multi-stage attack. If 7-Zip is rarely used or only for personal use on trusted files, risk is lower but patching remains advisable given the simplicity of the attack. The lack of KEV status indicates this is not yet an active attack vector, providing a window to patch before threat actors weaponize it.

Risk score, explained

CVSS 3.1 score of 6.5 (MEDIUM) reflects confidentiality impact (C:H) with no integrity or availability consequences (I:N, A:N). The score is suppressed from HIGH because exploitation requires user interaction and has no attack prerequisites (AC:L). The MEDIUM rating is appropriate for information disclosure without direct system compromise; however, risk may be elevated in organizations where the disclosed memory could contain cryptographic material or authentication tokens. Use your organization's risk rating framework to adjust priority based on the sensitivity of data that may reside in 7-Zip process memory at the time of exploitation.

Frequently asked questions