CVE-2026-48092 7-Zip SquashFS Fragment Offset Overflow (GHSL-2026-116)

What is CVE-2026-48092?

CVE-2026-48092 is a medium-severity vulnerability in mcmilk 7-Zip, published on 5 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

7-Zip is a file archiver with a high compression ratio. Versions 9.34 through 26.00 contain a heap memory disclosure via SquashFS fragment offset integer overflow on 32-bit builds. 32-bit integer overflow in the SquashFS ReadBlock function allows an attacker-controlled node.Offset value to bypass the fragment bounds check, causing memcpy to read heap memory preceding the cache buffer into the extracted file. The vulnerability is exploitable only on 32-bit builds of 7-Zip where size_t is 32 bits, allowing the addition offsetInBlock + blockSize to wrap modulo 2³². On 64-bit builds the addition is promoted to 64 bits and the check correctly rejects the input. Version 26.01 patches the issue.

Weakness: CWE-125

Which versions are affected by CVE-2026-48092?

It affects 1 product.

Products include 7-Zip 7-Zip.

How do I fix CVE-2026-48092?

Apply the vendor's patch.

Is CVE-2026-48092 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-48092 exists.

Other vulnerabilities in mcmilk 7-Zip

• CVE-2025-0411 7-Zip Mark of the Web Bypass Exploited High 7.0
• CVE-2008-6536 Other in n/a Critical 10.0
• CVE-2026-48095 GHSL-2026-140_7-Zip: 7-Zip has a heap buffer overflow via NTFS compressed stream buffer under-allocation High 8.8
• CVE-2018-10172 Privilege escalation in n/a High 8.8
• CVE-2016-2335 Memory corruption in n/a High 8.8

Sources

• CVE record
• NVD
• OSV
• How this page is made

Also known as ALPINE-CVE-2026-48092, DEBIAN-CVE-2026-48092, ECHO-5aa5-e5e2-e8ee, MINI-fx8h-jcj7-4w3m, UBUNTU-CVE-2026-48092.