CVE-2026-48112: GHSL-2026-122 7-Zip Ar SYMDEF OOB Read
7-Zip is a file archiver with a high compression ratio. Versions 9.18 through 26.00 contain a heap out-of-bounds read in 7-Zip Ar handler BSD SYMDEF parser. A 4-byte heap out-of-bounds read exists in the Unix ar archive parser in 7-Zip. When parsing a BSD-style .SYMDEF symbol table, the ParseLibSymbols function reads a 32-bit namesSize field via Get32 at a position that can equal the buffer size, reading 4 bytes past the end of the heap allocation. This reads uninitialized heap data under the default allocator. Version 26.01 patches the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48112?
The severity of CVE-2026-48112 is medium with a score of 6.5.
How do I fix CVE-2026-48112?
To fix CVE-2026-48112, upgrade to 7-Zip version 26.01 or later.
What type of vulnerability is CVE-2026-48112?
CVE-2026-48112 is a heap out-of-bounds read vulnerability in the 7-Zip Ar handler.
Which versions of 7-Zip are affected by CVE-2026-48112?
Versions 9.18 through 26.00 of 7-Zip are affected by CVE-2026-48112.
How can CVE-2026-48112 impact my system?
CVE-2026-48112 can potentially allow an attacker to read sensitive data from memory.