CVE-2026-48103: CWE-125: Out-of-bounds Read in mcmilk 7-Zip
7-Zip is a file archiver with a high compression ratio. Versions 9.34 through 26.00 contain an off-by-one heap out-of-bounds read in the WIM (Windows Imaging) archive handler's security descriptor lookup. In CHandler::GetSecurity (CPP/7zip/Archive/Wim/WimHandler.cpp), the per-image SecurOffsets table holds numEntries + 1 cumulative offsets, but the check securityId >= SecurOffsets.Size() admits securityId == numEntries, and the function then reads SecurOffsets[securityId + 1], fetching one UInt32 past the end of the heap-allocated CRecordVector (which performs no bounds checking on operator[]). The securityId is attacker-controlled at offset +0xC of any directory entry in WIM metadata, and the handler is registered for .wim, .swm, .esd, and .ppkg and enabled by default in stock 7z.dll; the OOB triggers zero-click in the GUI because 7zFM.exe's ListView calls GetRawProp(kpidNtSecure) for every item during listing (ASan-confirmed), and is also reachable via CLI listing with 7zz l -slt. Impact is limited to denial of service under hardened allocators and minor information disclosure, since the OOB value is only consumed arithmetically as a length and is not surfaced to the attacker; there is no write primitive.
AI Analysis
Technical Summary
CVE-2026-48103 is an off-by-one heap out-of-bounds read vulnerability in 7-Zip's WIM archive handler (CHandler::GetSecurity). The vulnerability arises because the per-image SecurOffsets table holds numEntries + 1 offsets, but the check allows securityId to equal numEntries, leading to reading one UInt32 past the allocated vector. The securityId is attacker-controlled from WIM metadata directory entries. This vulnerability can be triggered zero-click in the GUI during file listing or via CLI listing commands. The out-of-bounds read results in denial of service under hardened allocators and minor information disclosure. There is no write primitive or code execution impact.
Potential Impact
The vulnerability allows an attacker to cause a denial of service by triggering an out-of-bounds read, which may crash the application under hardened memory allocators. Additionally, minor information disclosure is possible due to reading memory beyond the intended bounds. There is no impact on confidentiality or integrity, and no code execution or write capabilities are present.
Mitigation Recommendations
No official patch or remediation has been confirmed at this time. Users should monitor the vendor advisory for updates and apply any official fixes once available. Until then, cautious handling of untrusted WIM, SWM, ESD, and PPKG files is advised to avoid triggering the vulnerability.
CVE-2026-48103: CWE-125: Out-of-bounds Read in mcmilk 7-Zip
Description
7-Zip is a file archiver with a high compression ratio. Versions 9.34 through 26.00 contain an off-by-one heap out-of-bounds read in the WIM (Windows Imaging) archive handler's security descriptor lookup. In CHandler::GetSecurity (CPP/7zip/Archive/Wim/WimHandler.cpp), the per-image SecurOffsets table holds numEntries + 1 cumulative offsets, but the check securityId >= SecurOffsets.Size() admits securityId == numEntries, and the function then reads SecurOffsets[securityId + 1], fetching one UInt32 past the end of the heap-allocated CRecordVector (which performs no bounds checking on operator[]). The securityId is attacker-controlled at offset +0xC of any directory entry in WIM metadata, and the handler is registered for .wim, .swm, .esd, and .ppkg and enabled by default in stock 7z.dll; the OOB triggers zero-click in the GUI because 7zFM.exe's ListView calls GetRawProp(kpidNtSecure) for every item during listing (ASan-confirmed), and is also reachable via CLI listing with 7zz l -slt. Impact is limited to denial of service under hardened allocators and minor information disclosure, since the OOB value is only consumed arithmetically as a length and is not surfaced to the attacker; there is no write primitive.
CVSS v3.1
Score 4.3medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-48103 is an off-by-one heap out-of-bounds read vulnerability in 7-Zip's WIM archive handler (CHandler::GetSecurity). The vulnerability arises because the per-image SecurOffsets table holds numEntries + 1 offsets, but the check allows securityId to equal numEntries, leading to reading one UInt32 past the allocated vector. The securityId is attacker-controlled from WIM metadata directory entries. This vulnerability can be triggered zero-click in the GUI during file listing or via CLI listing commands. The out-of-bounds read results in denial of service under hardened allocators and minor information disclosure. There is no write primitive or code execution impact.
Potential Impact
The vulnerability allows an attacker to cause a denial of service by triggering an out-of-bounds read, which may crash the application under hardened memory allocators. Additionally, minor information disclosure is possible due to reading memory beyond the intended bounds. There is no impact on confidentiality or integrity, and no code execution or write capabilities are present.
Mitigation Recommendations
No official patch or remediation has been confirmed at this time. Users should monitor the vendor advisory for updates and apply any official fixes once available. Until then, cautious handling of untrusted WIM, SWM, ESD, and PPKG files is advised to avoid triggering the vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-20T18:40:45.835Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a22fdf3e29bf47b50937323
Added to database: 06/05/2026, 16:48:51 UTC
Last enriched: 06/13/2026, 09:49:36 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 68
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.