Loading vulnerability…
Heap Out-of-Bounds Read in 7-Zip UDF File Identifier Descriptor Parser
CVE-2026-48102 is a heap out-of-bounds read in 7-Zip’s UDF disc image handler affecting versions 9.11 through 26.00. The flaw is in the File Identifier Descriptor parser, specifically CFileId::Parse in CPP/7zip/Archive/Udf/UdfIn.cpp. After validating that the record size is less than 38 + idLen + impLen and advancing the processed offset to 38 + impLen + idLen, the parser enters an alignment-padding loop intended to advance to a 4-byte boundary. That loop reads p[processed] while incrementing processed up to three times, but the processed <= size bounds check is performed only after the loop completes. If the parsed structure is exactly sized so that 38 + impLen + idLen equals the heap buffer size and the offset is not already 4-byte aligned, the loop reads 1 to 3 bytes past the end of the heap allocation created for the directory entry buffer. The vulnerable code path is reachable when 7-Zip opens, lists, or extracts a crafted UDF image. Because the UDF handler is associated with optical-disc image parsing and can be selected by file type or signature-based detection, exploitation can occur during normal archive processing of a malicious UDF-backed image.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
The vulnerability enables a limited heap out-of-bounds read of up to 3 bytes. Reported impact is primarily information disclosure and denial of service. Information disclosure is constrained: the flaw does not provide a write primitive or direct arbitrary memory disclosure, but can act as a small oracle based on open-versus-fail behavior for the out-of-bounds bytes. In hardened allocator environments, the invalid read may also terminate the process, causing a crash during archive open, listing, or extraction. No evidence is provided that the issue yields memory corruption or reliable code execution.
If you can’t patch tonight, do this now.
Until patched, avoid opening, listing, or extracting untrusted UDF or ISO disc images with vulnerable 7-Zip versions. Restrict processing of attacker-supplied archive and disc-image content in desktop and automated workflows, especially where 7-Zip is used for previewing or enumerating archive contents. Running archive handling in a sandboxed or isolated environment can reduce the impact of crashes or limited disclosure. Where feasible, disable or avoid UDF image handling in exposed workflows until the fixed version is deployed.
Patch, then assume compromise.
Upgrade 7-Zip to version 26.01 or later, which fixes the UDF parser out-of-bounds read. Any product bundling or redistributing vulnerable 7-Zip components should be updated to a build incorporating 26.01 or an equivalent vendor backport. If the software is embedded in another product, apply the vendor-supplied update that replaces the affected 7-Zip library or executable components.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.