CVE-2026-48112: 
7-Zip vulnerability analysis and mitigation

CVE-2026-48112 is a heap out-of-bounds read vulnerability in the Unix ar archive parser of 7-Zip, specifically in the BSD-style __.SYMDEF symbol table parser. Affecting versions 9.34 through 26.00, the ParseLibSymbols function reads a 32-bit namesSize field via Get32 at a position that can equal the buffer size, resulting in a 4-byte read past the end of the heap allocation and exposure of uninitialized heap data. The vulnerability was reported to the 7-Zip project on April 21, 2026, and patched in version 26.01 released April 27, 2026; it was publicly disclosed on June 5, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Security Lab).

Note: CVE-2026-48112 is one of eight vulnerabilities (GHSL-2026-115 through GHSL-2026-122) disclosed together in the same advisory, all affecting 7-Zip versions through 26.00.

The root cause is classified as CWE-125 (Out-of-bounds Read). In ParseLibSymbols (the Ar handler's BSD SYMDEF parser), the code checks size - pos < tableSize to ensure namesStart = pos + tableSize ≤ size, but this admits the boundary case where namesStart == size. The subsequent call to Get32(p.ConstData() + namesStart, be) then reads 4 bytes at offsets p[size..size+3] — past the end of the heap-allocated buffer. The post-read bounds check at line 478 (namesStart > size) that would catch this executes only after the OOB read has already occurred. The for (be = 0; be < 2; be++) retry loop causes the OOB read to occur twice (once little-endian, once big-endian). The vulnerability triggers during IInArchive::Open() — before any extraction — whenever the first or second archive member is named __.SYMDEF or __.SYMDEF SORTED. A PoC Python script generating a crafted 68-byte .a archive that triggers the bug is publicly available (GitHub Security Lab).

Successful exploitation results in limited information disclosure: the 4 OOB bytes are read into the local namesSize variable and used only in a subsequent bounds check (which always fails, causing continue), so the leaked bytes do not flow into any output stream directly visible to the attacker. The confidentiality impact is therefore constrained — uninitialized heap data is read but not surfaced to the attacker in the current implementation. There is no integrity or availability impact. The vulnerability is triggered during archive open operations on .a, .ar, .lib, and .deb files, requiring user interaction (opening a malicious archive) but no authentication or privileges (GitHub Security Lab).

1. Craft malicious archive: Use the public PoC Python script to generate a crafted .a (ar) archive. The minimal trigger is a 68-byte file with a __.SYMDEF member header and a 12-byte payload where tableSize=8, causing namesStart=12==size, positioning the Get32 read exactly 4 bytes past the end of the heap allocation.
2. Deliver the archive: Distribute the malicious .a, .ar, .lib, or .deb file to the target via email attachment, download link, or any other delivery mechanism that results in the victim opening it with 7-Zip.
3. Trigger the vulnerability: The victim opens the crafted archive with 7-Zip (double-click, drag-and-drop, or CLI 7zz l). The OOB read occurs during IInArchive::Open() — no extraction step is required.
4. OOB read occurs: ParseLibSymbols calls Get32(p.ConstData() + namesStart, be) reading 4 bytes past the heap allocation boundary, accessing uninitialized heap memory. The read occurs twice due to the endianness retry loop.
5. Limited disclosure: The OOB bytes are stored in namesSize and used only in a bounds check that fails, causing the function to continue. In the current implementation, the leaked bytes are not surfaced to the attacker via output (GitHub Security Lab).

• File System: Presence of unexpected or unsolicited .a, .ar, .lib, or .deb files delivered via email, downloads, or shared storage, particularly small files (~68 bytes) with a __.SYMDEF member.
• Logs: 7-Zip crash reports or abnormal termination logs when opening ar-format archives; application error logs referencing the Ar handler.
• Process: Unexpected crashes or access violations in the 7-Zip process (7z.exe, 7zz, 7zFM.exe) when processing .a/.ar/.lib/.deb files, particularly with ASan or similar instrumentation reporting heap-buffer-overflow in ArHandler.cpp.

Update 7-Zip to version 26.01 or later, which patches this vulnerability along with seven other memory safety issues disclosed in the same advisory. Version 26.01 was released on April 27, 2026. As a temporary workaround until patching is possible, avoid opening or extracting .a, .ar, .lib, or .deb ar-format archives from untrusted sources. Fedora and other Linux distributions have issued updated packages incorporating 7-Zip 26.01 (GitHub Security Lab).

The vulnerability was disclosed by Jaroslav Lobačevski of GitHub Security Lab as part of a coordinated disclosure covering eight separate memory safety issues in 7-Zip. The oss-security mailing list carried a notification shortly after public disclosure. Tenable released Nessus detection plugins (IDs 317897, 318790, 321160, 321161) for the affected 7-Zip versions. Fedora issued an update advisory incorporating the 7-Zip 26.01 fix. No significant social media controversy or vendor dispute has been observed (GitHub Security Lab, oss-security).