Executive brief
7-Zip is a widely used open-source file archiver for compressing and decompressing data. A vulnerability in how it handles Windows Imaging (WIM) files could allow a specially crafted archive to cause the application to crash or disclose small amounts of memory. This occurs automatically when a user simply opens a folder containing the malicious file in the 7-Zip interface, potentially leading to a denial of service or a minor leak of internal program information.
Technical details
An off-by-one heap out-of-bounds read exists in CHandler::GetSecurity within CPP/7zip/Archive/Wim/WimHandler.cpp. The SecurOffsets table holds numEntries + 1 cumulative offsets, but the bounds check (securityId >= SecurOffsets.Size()) incorrectly permits a securityId equal to numEntries. This causes the function to read one UInt32 past the end of the heap-allocated CRecordVector. The securityId is attacker-controlled via WIM metadata. The vulnerability is reachable via the GUI (7zFM.exe) during directory listing or via the CLI. Impact is primarily denial of service (crash) or minor information disclosure; no write primitive is available. Fixed in version 26.01.
Affected products
- 7-Zip 7-Zip 9.34 through 26.00
Timeline
- 2026-04-21: disclosed: Reported to vendor via SourceForge private issues.
- 2026-04-27: patched: Version 26.01 released with fixes.
- 2026-06-05: advisory: NVD publication date.