Loading vulnerability…
Heap out-of-bounds read in 7-Zip Ar BSD SYMDEF parser
CVE-2026-48112 is a four-byte heap out-of-bounds read in the BSD-style symbol table parser of 7-Zip's Unix ar archive handler. ParseLibSymbols reads the 32-bit namesSize field through Get32 before validating that sufficient bytes remain. The read position can equal the buffer size, causing access four bytes beyond the heap allocation and reading uninitialized heap data under the default allocator. The affected version range is inconsistently identified as 9.18–26.00 and 9.34–26.00. Version 26.01 fixes the vulnerability.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation causes a four-byte read beyond an allocated heap buffer and may expose uninitialized heap data. The extent to which an attacker can retrieve or control the disclosure is not established. Code execution, memory modification, and service disruption are not specifically established for this vulnerability.
If you can’t patch tonight, do this now.
No separate workaround is identified. For affected BigFix deployments, gather the updated BigFix Scanner and BigFix Inventory sites, stop open actions using outdated Inventory fixlets, and restart actions using the updated versions.
Patch, then assume compromise.
Upgrade 7-Zip to version 26.01 or later. For Echo-packaged installations, update the 7zip package and related packages to version 22.01+really26.01+dfsg-0+deb12u1 or later. For affected bundled components on Windows, upgrade BigFix Scanner to 11.0.43.0 or later using updated fixlets. For BigFix Inventory, gather the updated site, stop actions based on fixlets 20, 80, 2020, and 2021, and restart them using fixlet version 11.0.8.0.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.