CVE-2026-48101

Name of the Vulnerable Software and Affected Versions 7-Zip versions 9.21 through 26.00

Description An uninitialized memory disclosure exists in the UEFI capsule (.scap) parser. The OpenCapsule() function allocates a heap buffer based on an attacker-declared CapsuleImageSize (up to 1 GiB) without zero-initialization. The system then reads file contents into this buffer using ReadStream FALSE(), but the return value is discarded. If the file is truncated, the remaining part of the buffer retains uninitialized heap memory, which is subsequently exposed as extracted file content through GetStream().

Recommendations Update to version 26.0.1.