How severe is CVE-2026-48101?

CVE-2026-48101 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2026-48101 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (20th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-48101?

CVE-2026-48101 affects 7-zip. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-48101?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-48101 have an EU (EUVD) identifier?

Yes. CVE-2026-48101 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-34849.

When was CVE-2026-48101 published?

CVE-2026-48101 was published on 2026-06-05 and last updated on 2026-06-17.

CVE-2026-48101

CVE-2026-48101 is a medium-severity vulnerability in 7-zip with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-908.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
EPSS exploit prediction: 0% (20th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-34849
Weakness: CWE-908
Affected product: 7-zip
Published: 2026-06-05
Last modified: 2026-06-17

Description

7-Zip is a file archiver with a high compression ratio. Versions 9.21 through 26.00 contain an An uninitialized memory disclosure vulnerability in the UEFI capsule (.scap) parser in 7-Zip. The OpenCapsule function allocates a heap buffer of attacker-declared CapsuleImageSize (up to 1 GiB) without zero-initialization, then reads the file contents into it with ReadStream_FALSE whose return value is silently discarded. If the file is truncated, the unread tail of the buffer retains uninitialized heap memory, which is then exposed as extracted file content via GetStream. Version 26.0.1 fixes the issue.

Frequently asked questions

What is CVE-2026-48101?: 7-Zip is a file archiver with a high compression ratio. Versions 9.21 through 26.00 contain an An uninitialized memory disclosure vulnerability in the UEFI capsule (.scap) parser in 7-Zip. The OpenCapsule function allocates a heap buffer of attacker-declared CapsuleImageSize (up to 1 GiB) without zero-initialization, then reads the file contents into it with ReadStream_FALSE whose return value is silently discarded. If the file is truncated, the unread tail of the buffer retains uninitialized heap memory, which is then exposed as extracted file content via GetStream. Version 26.0.1 fixes the issue.
How severe is CVE-2026-48101?: CVE-2026-48101 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2026-48101 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (20th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-48101?: CVE-2026-48101 affects 7-zip. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-48101?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-48101 have an EU (EUVD) identifier?: Yes. CVE-2026-48101 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-34849.
When was CVE-2026-48101 published?: CVE-2026-48101 was published on 2026-06-05 and last updated on 2026-06-17.

References

https://securitylab.github.com/advisories/GHSL-2026-115_GHSL-2026-122_7-zip/

Affected products (1)

cpe:2.3:a:7-zip:7-zip:*:*:*:*:*:*:*:*

More vulnerabilities in 7-zip

CVE-2008-6536 — Critical (CVSS 10.0): Unspecified vulnerability in 7-zip before 4.5.7 has unknown impact and remote attack vectors, as demonstrated by the…
CVE-2026-48095 — High (CVSS 8.8): 7-Zip is a file archiver with a high compression ratio. Versions 26.00 and prior contain a heap buffer overflow…
CVE-2018-10172 — High (CVSS 8.8): 7-Zip through 18.01 on Windows implements the "Large memory pages" option by calling the LsaAddAccountRights function…
CVE-2016-2335 — High (CVSS 8.8): The CInArchive::ReadFileItem method in Archive/Udf/UdfIn.cpp in 7zip 9.20 and 15.05 beta and p7zip allows remote…
CVE-2025-11002 — High (CVSS 7.8): 7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote…
CVE-2025-11001 — High (CVSS 7.8): 7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote…

All CVEs affecting 7-zip →

Other CWE-908 (Use of Uninitialized Resource) vulnerabilities

CVE-2025-1942 — Critical (CVSS 9.8): When String.toUpperCase() caused a string to get longer it was possible for uninitialized memory to be incorporated…
CVE-2024-47540 — Critical (CVSS 9.8): GStreamer is a library for constructing graphs of media-handling components. An uninitialized stack variable…
CVE-2024-32611 — Critical (CVSS 9.8): HDF5 Library through 1.14.3 may use an uninitialized value in H5A__attr_release_table in H5Aint.c.
CVE-2023-24941 — Critical (CVSS 9.8): Windows Network File System Remote Code Execution Vulnerability
CVE-2022-26437 — Critical (CVSS 9.8): In httpclient, there is a possible out of bounds write due to uninitialized data. This could lead to remote escalation…
CVE-2021-45703 — Critical (CVSS 9.8): An issue was discovered in the tectonic_xdv crate before 0.1.12 for Rust. XdvParser::<T>::process may read from…

Browse all CWE-908 (Use of Uninitialized Resource) vulnerabilities →