CVE-2026-48092

NameCVE-2026-48092
Description7-Zip is a file archiver with a high compression ratio. Versions 9.34 through 26.00 contain a heap memory disclosure via SquashFS fragment offset integer overflow on 32-bit builds. 32-bit integer overflow in the SquashFS ReadBlock function allows an attacker-controlled node.Offset value to bypass the fragment bounds check, causing memcpy to read heap memory preceding the cache buffer into the extracted file. The vulnerability is exploitable only on 32-bit builds of 7-Zip where size_t is 32 bits, allowing the addition offsetInBlock + blockSize to wrap modulo 2³². On 64-bit builds the addition is promoted to 64 bits and the check correctly rejects the input. Version 26.01 patches the issue.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
7zip (PTS)bookworm22.01+really25.01+dfsg-0+deb12u1vulnerable
trixie25.01+dfsg-1~deb13u2vulnerable
forky, sid26.01+dfsg-2fixed
p7zip (PTS)bullseye16.02+dfsg-8vulnerable
bullseye (security)16.02+really25.01+dfsg-0+deb11u1vulnerable
bookworm16.02+really25.01+dfsg-0+deb12u1vulnerable
trixie16.02+transitional.1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
7zipsource(unstable)26.01+dfsg-1unimportant
p7zipsource(unstable)16.02+transitional.1unimportant

Notes

Since p7zip/16.02+transitional.1 src:p7zip is only a empty source package
depending on 7zip. Mark this version as fixed version.
https://securitylab.github.com/advisories/GHSL-2026-115_GHSL-2026-122_7-zip/
Crash in CLI tool, no security impact

Search for package or bug name: Reporting problems