CVE-2026-48103 GHSL-2026-119 7-Zip WIM SecurityId OOB read
An off-by-one heap out-of-bounds read in 7-Zip's WIM handler allows attackers to cause denial of service or minor information disclosure via crafted archives.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-48103?
CVE-2026-48103 is a medium-severity memory corruption vulnerability in mcmilk 7-Zip, published on 5 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
7-Zip is a file archiver with a high compression ratio. Versions 9.34 through 26.00 contain an off-by-one heap out-of-bounds read in the WIM (Windows Imaging) archive handler's security descriptor lookup. In CHandler::GetSecurity (CPP/7zip/Archive/Wim/WimHandler.cpp), the per-image SecurOffsets table holds numEntries + 1 cumulative offsets, but the check securityId >= SecurOffsets.Size() admits securityId == numEntries, and the function then reads SecurOffsets[securityId + 1], fetching one UInt32 past the end of the heap-allocated CRecordVector (which performs no bounds checking on operator[]). The securityId is attacker-controlled at offset +0xC of any directory entry in WIM metadata, and the handler is registered for .wim, .swm, .esd, and .ppkg and enabled by default in stock 7z.dll; the OOB triggers zero-click in the GUI because 7zFM.exe's ListView calls GetRawProp(kpidNtSecure) for every item during listing (ASan-confirmed), and is also reachable via CLI listing with 7zz l -slt. Impact is limited to denial of service under hardened allocators and minor information disclosure, since the OOB value is only consumed arithmetically as a length and is not surfaced to the attacker; there is no write primitive.
Weakness: CWE-125
Which versions are affected by CVE-2026-48103?
It affects 1 product.
Products include 7-Zip 7-Zip.
How do I fix CVE-2026-48103?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-48103 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-48103 exists.
Other vulnerabilities in mcmilk 7-Zip
Sources
Also known as ALPINE-CVE-2026-48103, DEBIAN-CVE-2026-48103, ECHO-3114-e2a8-c7cd, MINI-j8rf-6xmw-wphf, UBUNTU-CVE-2026-48103.