CVE-2026-125742
7-Zip before 26.06 Heap Out-of-Bounds Write via LZX Decoder in CAB Extraction
CVSS Score
7.8
EPSS Score
0.0%
EPSS Percentile
0th
7-Zip before 26.06 contains a heap out-of-bounds write vulnerability in the LZX decoder that lets attackers corrupt memory when a continuation CAB volume declares a smaller window. Attackers can entice victims to extract crafted multi-volume CAB archives, where a stale _pos value bypasses bounds checks, enabling arbitrary code execution.
| CWE | CWE-787 |
| Vendor | 7-zip |
| Product | 7-zip |
| Published | Nov 10, 2026 |
| Last Updated | Nov 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for 7-zip 7-zip
Be the first to know when new high vulnerabilities affecting 7-zip 7-zip are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
7-Zip / 7-Zip
0 < 26.06
References
github.com: https://github.com/ip7z/7zip/commit/d3296e39e1f1f92c7b41c0c3848e65640428d42d github.com: https://github.com/ip7z/7zip/releases/tag/26.06 github.com: https://github.com/ip7z/7zip/blob/26.05/CPP/7zip/Compress/LzxDecoder.cpp#L1496-L1513 potion-brew.pages.dev: https://potion-brew.pages.dev/posts/7zip-cab-lzx-window-desync-rce/ vulncheck.com: https://www.vulncheck.com/advisories/7-zip-before-26.06-heap-out-of-bounds-write-via-lzx-decoder-in-cab-extraction
Credits
Nguyễn Trần Thanh Lâm of Nanyang Technological University, and other researchers who wished to remain anonymous