Поиск уязвимостей
Количество 10
Количество 10
CVE-2026-48095
7-Zip is a file archiver with a high compression ratio. Versions 26.00 and prior contain a heap buffer overflow vulnerability caused by an under-allocation in the NTFS compressed stream buffer (GetCuSize shift UB), potentially allowing attackers to cause arbitrary code execution or application crashes. CInStream::GetCuSize() in the NTFS handler computes the compression-unit buffer size as (UInt32)1 << (BlockSizeLog + CompressionUnit), and a crafted image with ClusterSizeLog >= 28 and CompressionUnit == 4 drives the exponent to 32, which is undefined behavior and collapses on x86/x64 so _inBuf is allocated as 1 byte. ReadStream_FALSE then writes up to 256 MB of attacker-controlled data into that 1-byte buffer in 64 KB iterations, and because the CInStream object sits only 304 bytes after _inBuf, its vtable pointer is overwritten and the next dispatched call achieves a vtable hijack. On 32-bit builds the overflow is unconditionally reached; on 64-bit it requires the parallel 8 GB _out...
CVE-2026-48095
7-Zip is a file archiver with a high compression ratio. Versions 26.00 and prior contain a heap buffer overflow vulnerability caused by an under-allocation in the NTFS compressed stream buffer (GetCuSize shift UB), potentially allowing attackers to cause arbitrary code execution or application crashes. CInStream::GetCuSize() in the NTFS handler computes the compression-unit buffer size as (UInt32)1 << (BlockSizeLog + CompressionUnit), and a crafted image with ClusterSizeLog >= 28 and CompressionUnit == 4 drives the exponent to 32, which is undefined behavior and collapses on x86/x64 so _inBuf is allocated as 1 byte. ReadStream_FALSE then writes up to 256 MB of attacker-controlled data into that 1-byte buffer in 64 KB iterations, and because the CInStream object sits only 304 bytes after _inBuf, its vtable pointer is overwritten and the next dispatched call achieves a vtable hijack. On 32-bit builds the overflow is unconditionally reached; on 64-bit it requires the parallel 8 GB _outBuf
CVE-2026-48095
7-Zip is a file archiver with a high compression ratio. Versions 26.00 ...
BDU:2026-07292
Уязвимость функции CInStream::GetCuSize() обработчика NTFS архиватора 7-Zip, позволяющая нарушителю выполнить произвольный код или вызвать отказ в обслуживании
ROS-20260921-80-0028
Уязвимость 7zip
ROS-20260921-73-0025
Уязвимость 7zip
openSUSE-SU-2026:21038-1
Security update for 7zip
SUSE-SU-2026:2696-1
Security update for 7zip
ALT-PU-2026-6896
ALT-PU-2026-6896: package `7-zip` update to version 26.01-alt1
ALT-PU-2026-13491
ALT-PU-2026-13491: package `7-zip` update to version 26.02-alt1
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2026-48095 7-Zip is a file archiver with a high compression ratio. Versions 26.00 and prior contain a heap buffer overflow vulnerability caused by an under-allocation in the NTFS compressed stream buffer (GetCuSize shift UB), potentially allowing attackers to cause arbitrary code execution or application crashes. CInStream::GetCuSize() in the NTFS handler computes the compression-unit buffer size as (UInt32)1 << (BlockSizeLog + CompressionUnit), and a crafted image with ClusterSizeLog >= 28 and CompressionUnit == 4 drives the exponent to 32, which is undefined behavior and collapses on x86/x64 so _inBuf is allocated as 1 byte. ReadStream_FALSE then writes up to 256 MB of attacker-controlled data into that 1-byte buffer in 64 KB iterations, and because the CInStream object sits only 304 bytes after _inBuf, its vtable pointer is overwritten and the next dispatched call achieves a vtable hijack. On 32-bit builds the overflow is unconditionally reached; on 64-bit it requires the parallel 8 GB _out... | CVSS3: 8.8 | 1% Низкий | 5 месяцев назад |
 | CVE-2026-48095 7-Zip is a file archiver with a high compression ratio. Versions 26.00 and prior contain a heap buffer overflow vulnerability caused by an under-allocation in the NTFS compressed stream buffer (GetCuSize shift UB), potentially allowing attackers to cause arbitrary code execution or application crashes. CInStream::GetCuSize() in the NTFS handler computes the compression-unit buffer size as (UInt32)1 << (BlockSizeLog + CompressionUnit), and a crafted image with ClusterSizeLog >= 28 and CompressionUnit == 4 drives the exponent to 32, which is undefined behavior and collapses on x86/x64 so _inBuf is allocated as 1 byte. ReadStream_FALSE then writes up to 256 MB of attacker-controlled data into that 1-byte buffer in 64 KB iterations, and because the CInStream object sits only 304 bytes after _inBuf, its vtable pointer is overwritten and the next dispatched call achieves a vtable hijack. On 32-bit builds the overflow is unconditionally reached; on 64-bit it requires the parallel 8 GB _outBuf | CVSS3: 8.8 | 1% Низкий | 5 месяцев назад |
| CVE-2026-48095 7-Zip is a file archiver with a high compression ratio. Versions 26.00 ... | CVSS3: 8.8 | 1% Низкий | 5 месяцев назад |
 | BDU:2026-07292 Уязвимость функции CInStream::GetCuSize() обработчика NTFS архиватора 7-Zip, позволяющая нарушителю выполнить произвольный код или вызвать отказ в обслуживании | CVSS3: 8.8 | 1% Низкий | 7 месяцев назад |
 | ROS-20260921-80-0028 Уязвимость 7zip | CVSS3: 8.8 | 1% Низкий | около 2 месяцев назад |
| ROS-20260921-73-0025 Уязвимость 7zip | CVSS3: 8.8 | 1% Низкий | около 2 месяцев назад |
 | openSUSE-SU-2026:21038-1 Security update for 7zip | 5 месяцев назад | ||
| SUSE-SU-2026:2696-1 Security update for 7zip | 4 месяца назад | ||
| ALT-PU-2026-6896 ALT-PU-2026-6896: package `7-zip` update to version 26.01-alt1 | CVSS3: 8.8 | 6 месяцев назад | |
| ALT-PU-2026-13491 ALT-PU-2026-13491: package `7-zip` update to version 26.02-alt1 | CVSS3: 8.8 | 3 месяца назад |
Уязвимостей на страницу