endpoint-software-vulnerabilitywidely-deployed-product-advisoryopen-source-dependency-vulnerability

7-Zip 26.01 Fixes Multiple Memory Safety Flaws and SDK Path Traversal Bug

Vulnerability Disclosure · 2 sources · Updated 3mo ago · First seen May 22, 2026

GitHub Security Lab disclosed multiple vulnerabilities affecting 7-Zip 26.00 and earlier and a separate path traversal flaw in the 7zDec sample extractor from the LZMA SDK. The issues span several archive handlers, including SquashFS, UEFI capsule and firmware parsing, UDF, WIM, and Ar, and include out-of-bounds reads, uninitialized memory disclosure, integer overflow, and denial-of-service conditions. One SquashFS flaw affects only 32-bit builds, while several of the bugs reportedly impact versions dating back to the 7-Zip 9.x line.

A fixed release, 7-Zip 26.01, was published on SourceForge after private reporting by GitHub Security Lab researcher Jaroslav Lobačevski. The coordinated disclosure maps the findings to GHSL-2026-115 through GHSL-2026-122 and CVEs including CVE-2026-48092, CVE-2026-48101, CVE-2026-48102, CVE-2026-48103, CVE-2026-48104, CVE-2026-48111, and CVE-2026-48112; the SDK path traversal bug could allow arbitrary file write and potentially lead to code execution in affected sample-app implementations.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

3 events · Apr 21, 2026 – May 22, 2026

May 22, 20265mo ago
GitHub Security Lab publishes coordinated disclosure advisory
GitHub Security Lab publicly disclosed details of the coordinated vulnerability report for 7-Zip 26.00 and older versions and the 7zDec sample extractor. The advisory described affected components including SquashFS, UEFI capsule and firmware parsing, UDF, WIM, and Ar handlers, and documented impacts such as out-of-bounds reads, uninitialized memory disclosure, integer overflow, denial of service, and arbitrary file write.
GHSL-2026-115-GHSL-2026-122: Various memory access violations in 7-Zip | GitHub Security Lab
Apr 27, 20266mo ago
7-Zip 26.01 released with fixes for disclosed flaws
A fixed release, 7-Zip v26.01, was published to address the coordinatedly disclosed vulnerabilities affecting several archive handlers and the LZMA SDK sample extractor. The flaws were associated with GHSL advisories and CVEs including CVE-2026-48092, CVE-2026-48101, CVE-2026-48102, CVE-2026-48103, CVE-2026-48104, CVE-2026-48111, and CVE-2026-48112.
7-Zip / Discussion / Open Discussion: 7-Zip 26.01
Apr 21, 20266mo ago
GitHub Security Lab privately reports 7-Zip vulnerabilities
GitHub Security Lab researcher Jaroslav Lobačevski privately delivered a report covering multiple vulnerabilities in 7-Zip 26.00 and older versions, along with a path traversal issue in the 7zDec sample extractor from the LZMA SDK. The issues included memory access violations, denial of service conditions, and a sample-app arbitrary file write risk.
GHSL-2026-115-GHSL-2026-122: Various memory access violations in 7-Zip | GitHub Security Lab

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

7 linked

Uninitialized heap memory disclosure in the 7-Zip UEFI capsule parser (CVE-2026-48101)Heap out-of-bounds read in 7-Zip Ar BSD SYMDEF parser (CVE-2026-48112)Heap Out-of-Bounds Read in 7-Zip UDF File Identifier Descriptor Parser (CVE-2026-48102)Off-by-one heap out-of-bounds read in 7-Zip WIM security descriptor lookup (CVE-2026-48103)Off-by-one out-of-bounds read in 7-Zip UEFI dependency expression parser (CVE-2026-48111)7-Zip SquashFS Fragment Offset Overflow Heap Disclosure (CVE-2026-48092)Uninitialized heap read in the 7-Zip SquashFS handler (CVE-2026-48104)

Affected products

1 linked

7-Zip

Organizations

1 linked

7-Zip project

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Github Security Lab BlogAdvisories · May 22, 2026

GHSL-2026-115-GHSL-2026-122: Various memory access violations in 7-Zip | GitHub Security LabOpen source ↗

SourceforgeNews · Apr 27, 2026

7-Zip / Discussion / Open Discussion: 7-Zip 26.01Open source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

7-Zip 26.01 Fixes Multiple Memory Safety Flaws and SDK Path Traversal Bug

How this story unfolded

GitHub Security Lab publishes coordinated disclosure advisory

7-Zip 26.01 released with fixes for disclosed flaws

GitHub Security Lab privately reports 7-Zip vulnerabilities

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

7-Zip Fixed Multiple Parsing Flaws Including Critical NTFS Heap Overflow

7-Zip Fixes CVE-2026-14266 Remote Code Execution Flaw in XZ Parsing

Remote Code Execution Vulnerabilities in 7-Zip via Malicious ZIP Archives

7-Zip 26.01 Fixes Multiple Memory Safety Flaws and SDK Path Traversal Bug

How this story unfolded

GitHub Security Lab publishes coordinated disclosure advisory

7-Zip 26.01 released with fixes for disclosed flaws

GitHub Security Lab privately reports 7-Zip vulnerabilities

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

7-Zip Fixed Multiple Parsing Flaws Including Critical NTFS Heap Overflow

7-Zip Fixes CVE-2026-14266 Remote Code Execution Flaw in XZ Parsing

Remote Code Execution Vulnerabilities in 7-Zip via Malicious ZIP Archives