PatchSiren cyber security CVE debrief
CVE-2026-45384 rikyoz CVE debrief
CVE-2026-45384 is a MEDIUM severity vulnerability in bit7z, a cross-platform C++ static library. The issue allows for arbitrary file overwrite via a symlink attack on predictable temp files during archive updates. This vulnerability has been patched in version 4.0.12.
- Vendor
- rikyoz
- Product
- bit7z
- CVSS
- MEDIUM 6.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-10
- Original CVE updated
- 2026-06-11
- Advisory published
- 2026-06-10
- Advisory updated
- 2026-06-11
Who should care
Users of bit7z library versions prior to 4.0.12 should update to the latest version to mitigate this vulnerability.
Technical summary
The vulnerability exists in bit7z versions prior to 4.0.12. An attacker could exploit this vulnerability by creating a symlink to a target file, allowing for arbitrary file overwrite during archive updates.
Defensive priority
MEDIUM
Recommended defensive actions
- Update bit7z to version 4.0.12 or later.
Evidence notes
CVE-2026-45384 has a CVSS score of 6.1 and is classified as MEDIUM severity. The vulnerability was published on [cve-org] and additional details can be found on [nvd].
Sources and references
Verified primary and authoritative sources
-
CVE-2026-45384 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2026-45384
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2026-45384 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45384
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Supplemental references
-
Source reference
Unverified legacy reference
URL: https://github.com/rikyoz/bit7z/releases/tag/v4.0.12
-
Source reference
Unverified legacy reference
URL: https://github.com/rikyoz/bit7z/security/advisories/GHSA-wjch-42rm-q53h
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.