Loading vulnerability…
Uninitialized heap memory disclosure in the 7-Zip UEFI capsule parser
CVE-2026-48101 is an uninitialized heap memory disclosure vulnerability in the UEFI capsule parser in 7-Zip versions 9.21 through 26.00. OpenCapsule allocates a non-zero-initialized heap buffer using the attacker-declared CapsuleImageSize, supporting allocations up to 1 GiB. It then reads capsule contents using ReadStream_FALSE but discards the return value. A truncated capsule leaves the unread portion of the buffer uninitialized, and GetStream exposes those heap bytes as extracted file content.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Extraction of a crafted, truncated UEFI capsule can disclose uninitialized memory from the 7-Zip process heap. The disclosed bytes may contain residual process data; their contents depend on the heap state at allocation. This vulnerability specifically establishes information disclosure, not arbitrary code execution or arbitrary memory modification.
If you can’t patch tonight, do this now.
No separate technical workaround is specified. For affected BigFix deployments, gather the updated BigFix Scanner and BigFix Inventory sites, stop open actions based on outdated BigFix Inventory fixlets, and restart actions using the updated fixlet versions.
Patch, then assume compromise.
Upgrade affected 7-Zip installations to the fixed release or later. The CVE description identifies the fixed release as 26.0.1, while the coordinated disclosure identifies it as 26.01. For the referenced distribution packages, update the 7zip library and related packages to 22.01+really26.01+dfsg-0+deb12u1 or later. For affected HCL deployments, upgrade BigFix Scanner on Windows endpoints to 11.0.43.0 or later using updated fixlets, and update BigFix Inventory actions to use fixlet version 11.0.8.0.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.