PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-48102 mcmilk CVE debrief

CVE-2026-48102 is a heap out-of-bounds read vulnerability in 7-Zip, a file archiver with a high compression ratio. The vulnerability exists in the UDF disc image handler's File Identifier Descriptor parser, specifically in the `CFileId::Parse` function. An attacker can trigger the vulnerability by crafting a UDF image that causes the parser to read 1 to 3 bytes past the end of the exact-size heap buffer allocated for the image. This can lead to information disclosure and denial of service. The vulnerability has a CVSS score of 3.1 and is considered low severity.

Vendor
mcmilk
Product
7-Zip
CVSS
LOW 3.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-05
Original CVE updated
2026-06-10
Advisory published
2026-06-05
Advisory updated
2026-06-10

Who should care

Users of 7-Zip versions 9.11 through 26.00 should be aware of this vulnerability and take steps to mitigate it.

Technical summary

The vulnerability exists in the `CFileId::Parse` function in the UDF disc image handler. The function fails to properly validate the size of the heap buffer allocated for the image, leading to an out-of-bounds read. The vulnerability can be triggered by listing or extracting a crafted UDF image.

Defensive priority

Medium

Recommended defensive actions

  • Upgrade to 7-Zip version 26.01 or later.
  • Avoid listing or extracting untrusted UDF images.

Evidence notes

The vulnerability was discovered by security researchers at GitHub and reported to 7-Zip. A patch was released in version 26.01.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-48102 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-48102

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-48102 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-48102

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.