CVE-2026-48103 Overview
CVE-2026-48103 is an off-by-one heap out-of-bounds read in the 7-Zip Windows Imaging (WIM) archive handler. Versions 9.34 through 26.00 are affected. The flaw resides in CHandler::GetSecurity within CPP/7zip/Archive/Wim/WimHandler.cpp, where an attacker-controlled securityId field bypasses a bounds check and causes the handler to read one UInt32 past the end of the heap-allocated SecurOffsets table. The handler is registered by default for .wim, .swm, .esd, and .ppkg files, and the bug triggers zero-click in 7zFM.exe when the GUI lists archive contents. Impact is limited to denial of service and minor information disclosure [CWE-125].
Critical Impact
Opening or listing a crafted WIM archive in 7-Zip causes a zero-click out-of-bounds read in the default file manager, enabling denial of service.
Affected Products
- 7-Zip versions 9.34 through 26.00
- 7z.dll WIM archive handler (default-enabled)
- 7zFM.exe file manager and 7zz CLI listing operations
Discovery Timeline
- 2026-06-05 - CVE-2026-48103 published to NVD
- 2026-06-08 - Last updated in NVD database
Technical Details for CVE-2026-48103
Vulnerability Analysis
The vulnerability stems from an incorrect bounds check in the WIM security descriptor lookup routine. The per-image SecurOffsets table stores numEntries + 1 cumulative offsets, representing start positions for each security descriptor plus a terminating offset. The check securityId >= SecurOffsets.Size() permits securityId == numEntries, after which the function reads SecurOffsets[securityId + 1]. This fetches one UInt32 beyond the allocated CRecordVector, which performs no bounds validation in its operator[] implementation.
The out-of-bounds value is consumed arithmetically as a length and is never returned to the attacker. There is no write primitive. Under hardened heap allocators, the read can land on an unmapped page and crash the process, producing denial of service. The vulnerability is classified under [CWE-125] Out-of-Bounds Read.
Root Cause
The off-by-one error originates from a strict-versus-inclusive comparison mismatch. Because SecurOffsets holds numEntries + 1 elements, valid securityId values must satisfy securityId < numEntries, not securityId < SecurOffsets.Size(). The check accepts the boundary value numEntries, and the subsequent securityId + 1 indexing then reads the element immediately past the vector's backing storage.
Attack Vector
The securityId field is attacker-controlled at offset +0xC of any directory entry in WIM metadata. Exploitation requires only that a user open or browse to a crafted archive. In 7zFM.exe, the ListView control invokes GetRawProp(kpidNtSecure) for every item during archive enumeration, triggering the out-of-bounds read without any explicit user click on the malicious entry. The same path is reachable via the command line using 7zz l -slt. AddressSanitizer instrumentation confirms the boundary violation during normal listing operations.
No verified public exploit code is available. See the GitHub Security Lab advisory GHSL-2026-115/GHSL-2026-122 for full technical analysis.
Detection Methods for CVE-2026-48103
Indicators of Compromise
- Unexpected crashes of 7zFM.exe or 7zz when listing .wim, .swm, .esd, or .ppkg archives
- AddressSanitizer or Application Verifier reports flagging heap-buffer-overflow reads inside CHandler::GetSecurity
- WIM archives received via email, download, or shared storage containing anomalous securityId values at directory entry offset +0xC
Detection Strategies
- Inspect inbound WIM, SWM, ESD, and PPKG archives at email and web gateways and parse the security table to validate securityId values against numEntries.
- Hunt for 7-Zip process crashes correlated with archive enumeration activity in endpoint telemetry.
- Apply YARA rules targeting WIM headers with directory entries whose securityId matches the per-image numEntries count.
Monitoring Recommendations
- Monitor for unexpected termination of 7zFM.exe and 7zz processes following file open or directory browse events.
- Audit endpoints to inventory installed 7-Zip versions and flag installations between 9.34 and 26.00.
- Track downloads and email attachments with WIM-family extensions across the environment.
How to Mitigate CVE-2026-48103
Immediate Actions Required
- Upgrade 7-Zip to a version newer than 26.00 once the vendor publishes a fix.
- Restrict opening of untrusted .wim, .swm, .esd, and .ppkg archives until patched binaries are deployed.
- Inventory all endpoints running 7-Zip and prioritize systems handling externally sourced archives.
Patch Information
Refer to the GitHub Security Lab advisory for vendor remediation status. The fix involves correcting the bounds check in CHandler::GetSecurity so that securityId values equal to numEntries are rejected before indexing SecurOffsets[securityId + 1].
Workarounds
- Disable or unregister the WIM archive handler in 7z.dll where business workflows do not require it.
- Block WIM-family file extensions (.wim, .swm, .esd, .ppkg) at email and web proxies for users who do not process them.
- Open untrusted archives only inside sandboxed or isolated environments to contain any process crash.
# Example: block WIM-family extensions at a mail gateway (pseudo-config)
block_attachment_extensions = .wim, .swm, .esd, .ppkg
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
