CVE-2026-48112

Name of the Vulnerable Software and Affected Versions 7-Zip versions 9.18 through 26.00

Description A heap out-of-bounds read exists in the Unix ar archive parser within the BSD SYMDEF parser. When parsing a BSD-style .SYMDEF symbol table, the ParseLibSymbols() function uses Get32 to read a 32-bit namesSize field. If the position equals the buffer size, the system reads 4 bytes past the end of the heap allocation, which results in reading uninitialized heap data under the default allocator.

Recommendations Update to version 26.01.