CVE-2026-48101: 7-Zip uninitialized memory disclosure in UEFI capsule parser

CVE-2026-48101 · Severity: medium · CVSS 6.5 · Published 2026-06-05

7-Zip is a widely used file archiving utility for compressing and decompressing data. A security flaw in how it handles UEFI capsule (.scap) files allows a specially crafted archive to trick the program into exposing sensitive information from the computer's memory. This could result in private data from other applications or the system being leaked into the files extracted by the user.

Technologies: 7-Zip. Vendors: 7-Zip.

Quick answers

Is CVE-2026-48101 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-48101 being exploited in the wild.
How severe is CVE-2026-48101?
Medium severity, with a CVSS score of 6.5, published 5 June 2026.
Which products and versions are affected?
7-Zip 9.21 through 26.00.
Is there a fix for CVE-2026-48101?
A patch was published on 2026-04-27: Version 26.01 released with fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48101 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-48101?
Check whether you run 7-Zip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An uninitialized memory disclosure vulnerability exists in the UEFI capsule (.scap) parser of 7-Zip. The 'OpenCapsule' function allocates a heap buffer based on an attacker-controlled 'CapsuleImageSize' (up to 1 GiB) without zero-initialization. It then attempts to populate this buffer using 'ReadStream_FALSE'; however, the return value of this read operation is ignored. If the provided file is truncated, the unread portion of the buffer remains populated with stale heap memory. This uninitialized data is subsequently exposed to the user as extracted file content via 'GetStream'. The vulnerability is addressed in version 26.0.1.

Affected products

  • 7-Zip 7-Zip 9.21 through 26.00

Timeline

  • 2026-04-21: disclosed: Reported via SourceForge private issues
  • 2026-04-27: patched: Version 26.01 released with fixes
  • 2026-06-05: advisory: NVD publication date

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.