CVE-2026-48112: 7-Zip Heap Out-of-Bounds Vulnerability

CVE-2026-48112 Overview

CVE-2026-48112 is a heap out-of-bounds read vulnerability in 7-Zip, a widely deployed file archiver known for its high compression ratio. The flaw resides in the Unix ar archive handler, specifically the BSD-style __.SYMDEF symbol table parser. Versions 9.18 through 26.00 are affected. When a crafted archive triggers ParseLibSymbols, the function reads a 32-bit namesSize field via Get32 at an offset that can equal the buffer size. This results in a 4-byte read past the end of the heap allocation, exposing uninitialized heap memory. Version 26.01 contains the fix.

Critical Impact
A crafted ar archive can cause 7-Zip to read 4 bytes beyond a heap allocation, potentially leaking uninitialized heap memory contents.

Affected Products

7-Zip versions 9.18 through 26.00
All platforms shipping the 7-Zip Ar handler
Third-party applications embedding the affected 7-Zip code

Discovery Timeline

2026-06-05 - CVE-2026-48112 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-48112

Vulnerability Analysis

The vulnerability is a classic out-of-bounds read [CWE-125] in the 7-Zip Ar archive handler. The ar format is the Unix archive container used for static libraries and Debian .deb packages. BSD variants of ar store a symbol index in a member named __.SYMDEF. 7-Zip's ParseLibSymbols function parses this member to enumerate symbols and their referenced object files.

During parsing, the function calls Get32 to read a 32-bit namesSize value from the symbol table buffer. The offset calculation does not validate that the read remains strictly inside the allocated buffer. When the offset equals the buffer length, Get32 dereferences 4 bytes immediately after the allocation. The default heap allocator returns memory that may contain leftover data from prior allocations, allowing the parser to consume uninitialized heap bytes.

Exploitation requires user interaction. A victim must open or extract a malicious archive. The disclosed impact is confidentiality loss through small heap data leaks rather than memory corruption or code execution.

Root Cause

The root cause is missing bounds validation before a fixed-width read. ParseLibSymbols advances an offset into a heap buffer holding the __.SYMDEF member contents and reads the namesSize field without verifying that offset + 4 <= bufferSize. When the structure is malformed so that the offset lands exactly at the buffer end, the Get32 macro reads four bytes beyond the allocation boundary.

Attack Vector

An attacker delivers a crafted Unix ar archive containing a malformed BSD __.SYMDEF symbol table. Delivery channels include email attachments, web downloads, software supply chain artifacts, and shared file systems. When the user opens or extracts the archive with a vulnerable 7-Zip version, the parser triggers the out-of-bounds read. The leaked bytes are uninitialized heap data that may include fragments of previously freed allocations.

No exploit code is publicly available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The vulnerability mechanism is documented in the GitHub Security Advisory.

Detection Methods for CVE-2026-48112

Indicators of Compromise

Presence of .a, .ar, or .deb archive files from untrusted sources opened by 7z.exe or 7zG.exe
7-Zip process crashes or AddressSanitizer reports referencing ParseLibSymbols or CHandler::Open in the Ar handler
Unexpected child processes or file access patterns following extraction of ar archives

Detection Strategies

Inventory installed 7-Zip versions across the environment and flag any build at or below 26.00
Inspect archive contents at email and web gateways for ar members named __.SYMDEF with malformed size fields
Hunt for execution of 7z.exe against archive types not typical for the user population

Monitoring Recommendations

Log command-line invocations of 7z.exe, 7zG.exe, and 7zFM.exe along with the target file path
Monitor endpoint memory diagnostics for heap read faults inside 7-Zip processes
Track software inventory feeds for 7-Zip versions and alert on installations below 26.01

How to Mitigate CVE-2026-48112

Immediate Actions Required

Upgrade all 7-Zip installations to version 26.01 or later
Identify and update third-party tools that bundle or wrap the 7-Zip codebase
Restrict opening of ar, .a, and .deb archives from untrusted sources until patching is complete

Patch Information

7-Zip version 26.01 patches the bounds check in ParseLibSymbols so that the Get32 read on namesSize cannot extend past the allocation. Administrators should download the fixed release from the official 7-Zip distribution channel and validate the version string after deployment. Reference the GitHub Security Advisory GHSL-2026-115/GHSL-2026-122 for additional technical context.

Workarounds

Block inbound ar, .a, and .deb archives at email and web proxies where business needs allow
Open untrusted archives only inside isolated sandboxes or disposable virtual machines
Disable file-type associations that auto-launch 7-Zip on archive double-click for high-risk users

bash

# Verify installed 7-Zip version on Windows
"C:\Program Files\7-Zip\7z.exe" | findstr /C:"7-Zip"

# Verify installed 7-Zip version on Linux
7z | head -n 2

# Expected output should report version 26.01 or later