Loading vulnerability…
Off-by-one heap out-of-bounds read in 7-Zip WIM security descriptor lookup
CVE-2026-48103 affects the WIM archive handler in 7-Zip versions 9.34 through 26.00. CHandler::GetSecurity incorrectly validates an attacker-controlled securityId against a SecurOffsets table containing numEntries + 1 cumulative offsets. The check accepts securityId equal to numEntries, after which accessing SecurOffsets[securityId + 1] reads one 32-bit value beyond the heap allocation. The underlying CRecordVector indexing operation performs no bounds checking. The vulnerable lookup runs automatically when the File Manager lists archive entries and is also reachable through detailed command-line listing. The flaw can cause denial of service under hardened allocators and limited information disclosure; it provides no write primitive.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Processing a crafted archive can cause a denial of service under hardened allocators. Minor information disclosure is also described, but the out-of-bounds value is used only arithmetically as a length and is not directly exposed to the attacker. No write primitive is available, and arbitrary code execution is not established for this vulnerability.
If you can’t patch tonight, do this now.
Until patched, avoid opening, previewing, or listing untrusted WIM-related archives with affected 7-Zip versions, especially in the graphical file manager where metadata enumeration occurs automatically. Restrict handling of WIM, split WIM, ESD, and provisioning package files from untrusted sources, and use sandboxing or process isolation when inspection of such files is unavoidable. Reducing exposure of archive-processing workflows to attacker-supplied files lowers the likelihood of exploitation.
Patch, then assume compromise.
Upgrade 7-Zip to version 26.01 or later. For the identified Debian package stream, update the 7zip library and related packages to version 22.01+really26.01+dfsg-0+deb12u1 or later. For affected bundled deployments, HCL recommends upgrading BigFix Scanner on Windows endpoints to version 11.0.43.0 or later using updated fixlets. BigFix Inventory deployments should gather the updated site, stop actions based on outdated fixlets 20, 80, 2020, and 2021, and restart them using fixlet version 11.0.8.0.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.