CVE-2026-48102: 7-Zip UDF Heap Out-of-Bounds Read (v9.11–26.00)

Technical summary

The vulnerability exists in CFileId::Parse within 7zip/Archive/Udf/UdfIn.cpp. After validating that the combined size of identifier and implementation use fields plus a fixed 38-byte header fits within the buffer (size < 38 + idLen + impLen), the code advances a processing pointer and then enters an alignment-padding loop to reach a 4-byte boundary. The loop reads p[processed] while incrementing up to 3 times, but the bounds check (processed <= size) only executes after the loop completes. When the alignment requirement causes overflow—specifically when (38 + impLen + idLen) % 4 != 0 and the calculated offset equals the buffer size—1 to 3 bytes are read past the heap-allocated buffer boundary. The OOB read is triggered during Open() when the UDF handler processes the File Identifier Descriptor of a crafted disc image.

Business impact

Impact is contained to information disclosure and availability. The out-of-bounds read may leak 1 to 3 bytes of heap memory per successful trigger, though practical exploitation as an oracle is constrained by the need to infer leaked data through open/fail behavior. More immediately, the crash risk under memory-hardened allocators (ASAN, valgrind, or Windows guard pages) could disrupt workflows in environments processing untrusted archives. Organizations routinely using 7-Zip to extract or preview ISO/UDF files should prioritize patching to eliminate denial-of-service vectors and reduce information leakage risk in high-security contexts.

Affected systems

7-Zip versions 9.11 through 26.00 are affected. The vulnerability manifests when the UDF handler processes .iso or .udf files; the handler is auto-registered and auto-detected by file signature, so it triggers on any matching disc image regardless of file extension. The flaw impacts all platforms where 7-Zip is deployed (Windows, Linux, macOS). End-users and administrators distributing 7-Zip as a utility for archive inspection are at risk if they process untrusted archives.

Exploitability

Exploitation requires user interaction—a victim must open or list the contents of a crafted UDF disc image using 7-Zip (or an integrated tool that invokes the library). The CVSS vector AV:N/AC:H/UI:R reflects that attack complexity is high and user interaction mandatory. An attacker cannot remotely trigger the flaw without social engineering or distribution of malicious archives. The lack of a write primitive means attackers cannot corrupt data or escalate privilege; leakage is limited to reading nearby heap contents via repeated crafted archives and behavioral observation, and crashes are denial-of-service only.

Remediation

Upgrade to 7-Zip version 26.01 or later, which addresses the bounds-check sequencing flaw. The fix ensures the alignment-padding loop cannot read past the buffer boundary. Administrators should push this update through their software distribution channels. Interim mitigation for users unable to patch immediately: restrict processing of 7-Zip on untrusted or unsolicited ISO/UDF files, and disable auto-detection of the UDF handler if the tool configuration permits. Monitor systems using 7-Zip for unexpected crashes when opening archives.

Patch guidance

Apply 7-Zip version 26.01 or newer. Verify the update in Software > 7-Zip (or equivalent inventory) and confirm the version string post-deployment. No configuration changes are required after patching. If your environment uses 7-Zip as a library (embedded in third-party tools), verify that the hosting application has been updated to bundle the patched 7-Zip release; check vendor advisories for dependent products.

Detection guidance

Monitor for crashes or errors in 7-Zip processes, particularly when handling .iso or .udf files. Under Windows, watch for 'Unhandled Exception' or 'Buffer Overrun' messages in Event Viewer. On Unix-like systems, check syslog for segmentation faults associated with 7z or 7za binaries. Intrusion detection rules specific to this CVE are unlikely to surface quickly; instead, focus on monitoring process termination and stderr output when opening untrusted archives. Network-based detection is impractical (the trigger is local file parsing), but you may flag inbound transmission of suspicious .iso files in high-control environments.

Why prioritize this

Despite the LOW CVSS score (3.1), patch promptly because: (1) the vulnerability is universal across 7-Zip versions for nearly two decades, creating broad exposure; (2) crash risk is direct and reproducible in hardened environments; (3) the fix is simple, non-breaking, and available; (4) no active in-the-wild exploitation is known, making this a controlled, low-urgency upgrade window. Prioritize organizations processing untrusted archives or running 7-Zip in security-critical workflows (malware analysis labs, digital forensics tools).

Risk score, explained

The CVSS 3.1 score of 3.1 (LOW) reflects limited impact: confidentiality is slightly compromised (C:L), integrity and availability are unaffected in the vector (I:N/A:N). Attack complexity is high (AC:H) due to the precise buffer-alignment condition required, and user interaction is mandatory (UI:R). Network accessibility is present (AV:N) because archives can be delivered remotely, but the flaw is triggered only on local file parsing. The score does not weight the broad version range or frequency of 7-Zip usage; practitioners should weigh organizational exposure (how often untrusted archives are processed) separately.

Frequently asked questions