Executive brief
7-Zip is a widely used file archiving utility for compressing and decompressing data. A vulnerability in its UDF disc image handler allows a specially crafted .iso or .udf file to trigger a small memory leak or a program crash. While the risk of data theft is low, an attacker could use this to crash the application or potentially gain minor insights into system memory when a user attempts to open a malicious disc image.
Technical details
A heap out-of-bounds read exists in the CFileId::Parse function within CPP/7zip/Archive/Udf/UdfIn.cpp. The vulnerability is caused by an alignment-padding loop that increments a pointer to reach a 4-byte boundary before performing a bounds check. If a crafted UDF image specifies a size that is not 4-byte aligned and matches the current processed length, the loop reads 1 to 3 bytes past the allocated heap buffer. This can be exploited via a malicious .iso or .udf file to create a 1-bit oracle for information disclosure or cause a denial of service (crash) under hardened memory allocators. The issue is fixed in version 26.01.
Affected products
- 7-Zip 7-Zip 9.11 through 26.00
Timeline
- 2026-04-21: disclosed: Reported via SourceForge private issues
- 2026-04-27: patched: Version 26.01 released with fixes
- 2026-06-05: advisory: CVE-2026-48102 published