The 7zip 26.01 update fixes several security issues: CVE-2026-48092 involves information disclosure in 32-bit builds due to heap memory disclosure; CVE-2026-48095 is a heap buffer overflow caused by under-allocation in NTFS compressed stream buffers; CVE-2026-48101 concerns information disclosure via uninitialized memory in the UEFI capsule parser; CVE-2026-48102 involves information disclosure and denial of service via crafted UDF images; CVE-2026-48103 and CVE-2026-48111 are off-by-one heap out-of-bounds reads; CVE-2026-48104 is an uninitialized heap read in the SquashFS archive handler; and CVE-2026-48112 is a heap out-of-bounds read in the BSD SYMDEF parser. These vulnerabilities collectively pose risks of information leakage, memory corruption, and service disruption. The update also includes performance enhancements and bug fixes unrelated to security.

The vulnerabilities fixed in this update can lead to information disclosure, heap buffer overflows, out-of-bounds memory reads, and denial of service conditions. These issues could potentially allow attackers to access sensitive memory contents or cause application crashes. The impact is significant enough to warrant a high severity rating, but no known exploits in the wild have been reported at this time.

Users should apply the 7zip update to version 26.01 as provided by the SUSE Product Security Team to remediate these vulnerabilities. This update contains official fixes for all listed issues. No additional mitigations are specified or required beyond applying this update.