CVE-2026-48102

Name of the Vulnerable Software and Affected Versions 7-Zip versions 9.11 through 26.00

Description A heap out-of-bounds read of up to 3 bytes exists in the UDF disc image handler's File Identifier Descriptor parser. In the CFileId::Parse() function, an alignment-padding loop reads data to reach a 4-byte boundary, but the bounds check occurs only after the loop has executed. When the sum of the fixed header size and lengths is equal to the buffer size and not aligned to 4 bytes, the system reads past the end of the heap buffer allocated via buf.Alloc(). This issue affects .iso and .udf files and is triggered during the Open() process when listing or extracting a crafted UDF image. The impact is limited to denial of service, causing crashes under hardened allocators, and information disclosure via a 1-bit oracle per out-of-bounds byte.

Recommendations Update to version 26.01.