CVE-2026-48102

7-Zip is a file archiver with a high compression ratio. Versions 9.11 through 26.00 contain a heap out-of-bounds read of up to 3 bytes in the UDF disc image handler's File Identifier Descriptor parser. In CFileId::Parse (CPP/7zip/Archive/Udf/UdfIn.cpp), after validating size < 38 + idLen + impLen and advancing processed to 38 + impLen + idLen, the alignment-padding loop reads p[processed] while incrementing up to 3 times to reach a 4-byte boundary, and the processed <= size bounds check only runs after the loop. When (38 + impLen + idLen) % 4 != 0 and 38 + impLen + idLen == size, the loop reads 1 to 3 bytes past the end of the exact-size heap buffer allocated via buf.Alloc((size_t)item.Size). The UDF handler is registered for .iso and .udf files and auto-detected by signature, and the OOB read triggers during Open() when listing or extracting a crafted UDF image. Impact is limited to information disclosure (a 1-bit oracle per OOB byte via open/fail behavior) and denial of service (crash under hardened allocators); there is no write primitive. Version 26.01 fixes the issue.

• CWE-125

• https://securitylab.github.com/advisories/GHSL-2026-115_GHSL-2026-122_7-zip/Exploit, Patch, Third Party Advisory
• https://securitylab.github.com/advisories/GHSL-2026-115_GHSL-2026-122_7-zip/Exploit, Patch, Third Party Advisory

Published

Jun 5, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-480957-Zip is a file archiver with a high compression ratio. Vers…8.8
• CVE-2026-48096OpenFGA is an authorization/permission engine built for deve…5.3
• CVE-2026-48097NexTor IP Changer is a command-line tool that leverages the …7.8
• CVE-2026-48098NexTor IP Changer is a command-line tool that leverages the …7.3
• CVE-2026-4810A Code Injection and Missing Authentication vulnerability in…9.3
• CVE-2026-481017-Zip is a file archiver with a high compression ratio. Vers…6.5
• CVE-2026-481037-Zip is a file archiver with a high compression ratio. Vers…7.1
• CVE-2026-481047-Zip is a file archiver with a high compression ratio. Vers…4.2
• CVE-2026-48107Russh is a Rust SSH client & server library. From version 0.…6.5
• CVE-2026-48108Russh is a Rust SSH client & server library. From version 0.…5.3
• CVE-2026-48109MessagePack for C# is a MessagePack serializer for C#. Prior…8.2
• CVE-2026-4811The WPB Floating Menu & Categories for WordPress – Sticky Si…4.9