DEBIAN-CVE-2026-48101
7-Zip is a file archiver with a high compression ratio. Versions 9.21 through 26.00 contain an An uninitialized memory disclosure vulnerability in the UEFI capsule (.scap) parser in 7-Zip. The OpenCapsule function allocates a heap buffer of attacker-declared CapsuleImageSize (up to 1 GiB) without zero-initialization, then reads the file contents into it with ReadStream_FALSE whose return value is silently discarded. If the file is truncated, the unread tail of the buffer retains uninitialized heap memory, which is then exposed as extracted file content via GetStream. Version 26.0.1 fixes the issue.
DEBIAN-CVE-2026-48101
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-48101
7zip
Source reference: /affected/0/package/name
- Affected versions
- 22.01+dfsg-10~exp1
Source reference:
/affected/0/versions22.01+dfsg-8Source reference:
/affected/0/versions22.01+dfsg-8+deb12u1Source reference:
/affected/0/versions22.01+dfsg-9Source reference:
/affected/0/versions22.01+really25.01+dfsg-0+deb12u1Source reference:
/affected/0/versions - Fixed versions
- 22.01+really26.01+dfsg-0+deb12u1
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
7zip
Source reference: /affected/1/package/name
- Affected versions
- 24.09+dfsg-8
Source reference:
/affected/1/versions25.00+dfsg-1Source reference:
/affected/1/versions25.01+dfsg-1Source reference:
/affected/1/versions25.01+dfsg-1~deb13u1Source reference:
/affected/1/versions25.01+dfsg-1~deb13u1~bpo12+1Source reference:
/affected/1/versions25.01+dfsg-1~deb13u2Source reference:
/affected/1/versions25.01+dfsg-2Source reference:
/affected/1/versions25.01+dfsg-3Source reference:
/affected/1/versions25.01+dfsg-4Source reference:
/affected/1/versions25.01+dfsg-5Source reference:
/affected/1/versions26.00+dfsg-1Source reference:
/affected/1/versions26.00+dfsg-2Source reference:
/affected/1/versions26.00+dfsg-3Source reference:
/affected/1/versions26.00+dfsg-4Source reference:
/affected/1/versions26.00+dfsg-5Source reference:
/affected/1/versions26.00+dfsg1-1Source reference:
/affected/1/versions26.00+dfsg1-2Source reference:
/affected/1/versions26.00+dfsg1-3Source reference:
/affected/1/versions26.01+dfsg-1Source reference:
/affected/1/versions26.01+dfsg-2Source reference:
/affected/1/versions26.01+dfsg-3Source reference:
/affected/1/versions26.02+dfsg-1Source reference:
/affected/1/versions26.02+dfsg-2Source reference:
/affected/1/versions26.02+dfsg-3Source reference:
/affected/1/versions26.03+dfsg-1Source reference:
/affected/1/versions26.03+dfsg-2Source reference:
/affected/1/versions26.03+dfsg-3Source reference:
/affected/1/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
7zip
Source reference: /affected/2/package/name
- Affected versions
- 24.09+dfsg-8
Source reference:
/affected/2/versions25.00+dfsg-1Source reference:
/affected/2/versions25.01+dfsg-1Source reference:
/affected/2/versions25.01+dfsg-1~deb13u1Source reference:
/affected/2/versions25.01+dfsg-1~deb13u1~bpo12+1Source reference:
/affected/2/versions25.01+dfsg-1~deb13u2Source reference:
/affected/2/versions25.01+dfsg-2Source reference:
/affected/2/versions25.01+dfsg-3Source reference:
/affected/2/versions25.01+dfsg-4Source reference:
/affected/2/versions25.01+dfsg-5Source reference:
/affected/2/versions26.00+dfsg-1Source reference:
/affected/2/versions26.00+dfsg-2Source reference:
/affected/2/versions26.00+dfsg-3Source reference:
/affected/2/versions26.00+dfsg-4Source reference:
/affected/2/versions26.00+dfsg-5Source reference:
/affected/2/versions26.00+dfsg1-1Source reference:
/affected/2/versions26.00+dfsg1-2Source reference:
/affected/2/versions26.00+dfsg1-3Source reference:
/affected/2/versions - Fixed versions
- 26.01+dfsg-1
Source reference:
/affected/2/ranges - Prerequisites
- Not stated in this record
p7zip
Source reference: /affected/3/package/name
- Affected versions
- 16.02+dfsg-8
Source reference:
/affected/3/versions16.02+really25.01+dfsg-0+deb12u1Source reference:
/affected/3/versions - Fixed versions
- 16.02+really26.01+dfsg-0+deb12u1
Source reference:
/affected/3/ranges - Prerequisites
- Not stated in this record
p7zip
Source reference: /affected/4/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 16.02+transitional.1
Source reference:
/affected/4/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "22.01+really26.01+dfsg-0+deb12u1"
}
]
}
],
"package": {
"name": "7zip",
"purl": "pkg:deb/debian/7zip?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"22.01+dfsg-10~exp1",
"22.01+dfsg-8",
"22.01+dfsg-8+deb12u1",
"22.01+dfsg-9",
"22.01+really25.01+dfsg-0+deb12u1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-48101.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "7zip",
"purl": "pkg:deb/debian/7zip?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"24.09+dfsg-8",
"25.00+dfsg-1",
"25.01+dfsg-1",
"25.01+dfsg-1~deb13u1",
"25.01+dfsg-1~deb13u1~bpo12+1",
"25.01+dfsg-1~deb13u2",
"25.01+dfsg-2",
"25.01+dfsg-3",
"25.01+dfsg-4",
"25.01+dfsg-5",
"26.00+dfsg-1",
"26.00+dfsg-2",
"26.00+dfsg-3",
"26.00+dfsg-4",
"26.00+dfsg-5",
"26.00+dfsg1-1",
"26.00+dfsg1-2",
"26.00+dfsg1-3",
"26.01+dfsg-1",
"26.01+dfsg-2",
"26.01+dfsg-3",
"26.02+dfsg-1",
"26.02+dfsg-2",
"26.02+dfsg-3",
"26.03+dfsg-1",
"26.03+dfsg-2",
"26.03+dfsg-3"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-48101.json"
},
"ecosystem_specific": {
"urgency": "unimportant"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "26.01+dfsg-1"
}
]
}
],
"package": {
"name": "7zip",
"purl": "pkg:deb/debian/7zip?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"24.09+dfsg-8",
"25.00+dfsg-1",
"25.01+dfsg-1",
"25.01+dfsg-1~deb13u1",
"25.01+dfsg-1~deb13u1~bpo12+1",
"25.01+dfsg-1~deb13u2",
"25.01+dfsg-2",
"25.01+dfsg-3",
"25.01+dfsg-4",
"25.01+dfsg-5",
"26.00+dfsg-1",
"26.00+dfsg-2",
"26.00+dfsg-3",
"26.00+dfsg-4",
"26.00+dfsg-5",
"26.00+dfsg1-1",
"26.00+dfsg1-2",
"26.00+dfsg1-3"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-48101.json"
},
"ecosystem_specific": {
"urgency": "unimportant"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "16.02+really26.01+dfsg-0+deb12u1"
}
]
}
],
"package": {
"name": "p7zip",
"purl": "pkg:deb/debian/p7zip?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"16.02+dfsg-8",
"16.02+really25.01+dfsg-0+deb12u1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-48101.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "16.02+transitional.1"
}
]
}
],
"package": {
"name": "p7zip",
"purl": "pkg:deb/debian/p7zip?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-48101.json"
},
"ecosystem_specific": {
"urgency": "unimportant"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #56603 · Revision 1
- Added to Heist Feed
- Publisher date