CVE-2026-48112: 7-Zip Heap Out-of-Bounds Read in AR Archive Handler

Technical summary

The ParseLibSymbols function in 7-Zip's ar archive handler contains a heap out-of-bounds read (CWE-125). When parsing a BSD SYMDEF symbol table, the function retrieves a 32-bit namesSize field via a Get32 call at an offset that can equal or exceed the buffer size, resulting in a 4-byte read past the heap allocation boundary. Under typical memory allocators, this reads uninitialized heap data rather than crashing immediately. The integer handling (CWE-190) contributes to the boundary condition. This is a read-only violation; no memory corruption or code execution occurs.

Business impact

This vulnerability poses a confidentiality risk to users who extract or preview ar archives from untrusted sources. Leaked heap memory could contain sensitive application state, cached credentials, or other process data. Organizations that rely on 7-Zip for secure handling of archived source code, software packages, or sensitive documents should treat this as a data leakage concern. The impact is localized to the 7-Zip process and does not enable lateral movement or system compromise.

Affected systems

7-Zip versions 9.18 through 26.00 are affected. Version 26.01 and later contain the patch. Systems running older or unpatched 7-Zip installations are vulnerable. The defect exists in the Unix ar archive parser, so it affects all platforms on which 7-Zip is compiled with ar handler support, including Windows, macOS, and Linux.

Exploitability

Exploitation requires crafting a specially formatted ar archive with a malicious BSD SYMDEF symbol table and delivering it to a user. The user must then open or extract the archive in 7-Zip. There is no network exploitation vector; this is file-based. The required user interaction (opening a file) and the need to construct a valid ar structure moderately raise the barrier, but well-formed payloads are feasible for an attacker with archive format knowledge. The vulnerability does not appear on the KEV catalog, indicating no known active exploitation in the wild as of publication.

Remediation

Update 7-Zip to version 26.01 or later. For organizations unable to patch immediately, implement file-type controls: disable or restrict 7-Zip's ability to open ar archives from untrusted sources, or use alternate archival tools for sensitive workflows. Consider user training to avoid opening archive files from unknown origins. Monitor for signs of suspicious memory leaks or crashes when 7-Zip processes archives.

Patch guidance

Upgrade to 7-Zip version 26.01 or any subsequent release. Verify the version in your deployment by checking Help > About or the version string in automated inventory tools. Test the patch in a non-production environment first to ensure compatibility with your archive workflows. For containerized or managed deployments, rebuild images with the patched 7-Zip binary. No configuration changes are required post-patch; the fix is transparent.

Detection guidance

Monitor process heap behavior and memory access patterns when 7-Zip opens ar archives. Tools like AddressSanitizer or Valgrind can detect the out-of-bounds read during testing. In production, watch for unexpected process termination or memory errors in 7-Zip logs. Network-based detection is not applicable; file integrity monitoring on archive repositories and access logs for ar files can help identify suspicious activity. Endpoint detection and response (EDR) systems may flag abnormal memory access patterns if configured to monitor application heap operations.

Why prioritize this

This vulnerability merits prompt but not emergency patching. The CVSS score of 6.5 (Medium severity) reflects the confidentiality impact and the requirement for user action. It does not enable code execution or privilege escalation. Prioritize patching in environments where 7-Zip frequently processes archives from external or untrusted sources—such as development teams, security researchers, or content analysis pipelines. Organizations whose 7-Zip usage is limited to internal, vetted archives face lower risk and can schedule updates in normal maintenance windows.

Risk score, explained

The CVSS 3.1 score of 6.5 (Medium) is justified by: (1) high confidentiality impact (C:H)—uninitialized heap disclosure can leak sensitive data; (2) no integrity or availability impact—the read is out-of-bounds but does not corrupt memory or crash the application; (3) network-accessible attack vector (AV:N)—the archive can be delivered remotely; (4) low attack complexity (AC:L)—crafting a malicious ar file is straightforward; (5) no privileges required (PR:N); (6) required user interaction (UI:R)—the victim must open the file. The absence of scope change (S:U) caps the severity at Medium.

Frequently asked questions