Threats tagged 'ghsa-vfpw-mfgh-fqwf'

7-Zip versions before 26.06 have a heap out-of-bounds write vulnerability in the LZX decoder. This flaw occurs when processing continuation CAB volumes that declare a smaller window, leading to memory corruption. An attacker can craft multi-volume CAB archives that exploit a stale _pos value to bypass bounds checks, potentially allowing arbitrary code execution when a victim extracts these archives.