CVE-2026-48103

Name of the Vulnerable Software and Affected Versions 7-Zip versions 9.34 through 26.00

Description An off-by-one heap out-of-bounds read exists in the WIM (Windows Imaging) archive handler's security descriptor lookup. In the GetSecurity() function within CHandler::GetSecurity (CPP/7zip/Archive/Wim/WimHandler.cpp), the SecurOffsets table contains numEntries + 1 cumulative offsets. However, the check securityId >= SecurOffsets.Size() allows securityId to equal numEntries, leading the function to read SecurOffsets[securityId + 1]. This results in fetching one UInt32 past the end of the heap-allocated CRecordVector. The securityId is controlled by an attacker at offset +0xC of any directory entry in WIM metadata. This issue affects handlers for .wim, .swm, .esd, and .ppkg files, which are enabled by default in 7z.dll. The flaw can be triggered without user interaction in the GUI because 7zFM.exe's ListView calls GetRawProp(kpidNtSecure) for every item during listing, and it is also reachable via the command line using 7zz l -slt. The impact is limited to denial of service or minor information disclosure, as the out-of-bounds value is used arithmetically as a length and is not directly exposed to the attacker.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.