{"id":"CVE-2026-125742","kind":"vulnerability","aliases":["CVE-2026-125742"],"related":[],"title":"7-Zip: crafted CAB archive lets attackers run code on extraction","description":"7-Zip before 26.06 contains a heap out-of-bounds write vulnerability in the LZX decoder that lets attackers corrupt memory when a continuation CAB volume declares a smaller window. Attackers can entice victims to extract crafted multi-volume CAB archives, where a stale _pos value bypasses bounds checks, enabling arbitrary code execution.","summary":"7-Zip contains a heap out-of-bounds write in its LZX decoder that a crafted multi-volume CAB archive can trigger. An attacker who gets a victim to extract that archive can corrupt memory and execute arbitrary code.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["7-zip","desktop","package","windows"],"not_affected_if":["7-zip-26.06-or-later","no-cab-extraction"],"how_to_check":"- Check the installed 7-Zip version (Help > About 7-Zip, or `7z i`) and compare it with the fixed version below.\n- Look for `.cab` multi-volume archives from untrusted sources in download or extraction folders.","fix":"- 7-Zip: upgrade to `26.06` or later.","status":"open","published_at":"2026-11-10T12:17:18+00:00","first_seen_at":"2026-11-10T12:21:54+00:00","triaged_at":"2026-11-10T12:22:32+00:00","updated_at":"2026-11-10T12:22:32+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-10T12:22:32Z","model":"claude-haiku-5-5","output":{"fix":"- 7-Zip: upgrade to `26.06` or later.","reach":"local","title":"7-Zip: crafted CAB archive lets attackers run code on extraction","impact":"high","summary":"7-Zip contains a heap out-of-bounds write in its LZX decoder that a crafted multi-volume CAB archive can trigger. An attacker who gets a victim to extract that archive can corrupt memory and execute arbitrary code.","audience":"everyone","category":"package","nicknames":[],"who_cares":["7-zip","windows","desktop"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Arbitrary code runs as the user who extracted the archive.","analyst_note":"","how_to_check":"- Check the installed 7-Zip version (Help > About 7-Zip, or `7z i`) and compare it with the fixed version below.\n- Look for `.cab` multi-volume archives from untrusted sources in download or extraction folders.","plain_action":"Update 7-Zip to version 26.06 or later, and do not open CAB archives from people you do not trust until you have.","product_name":"","needs_analyst":false,"not_affected_if":["7-zip-26.06-or-later","no-cab-extraction"],"who_is_affected":"Anyone who extracts multi-volume CAB archives with a 7-Zip build older than 26.06. Exposure needs a user to open a crafted archive, so systems that never extract untrusted CAB files are at lower risk.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000736,"input_tokens":4635,"output_tokens":545,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-125742':14A,17A '-2026':13A,16A '26.06':67C '7':1A,18B,23B,64C 'arbitrari':62B,116C 'archiv':5A,44B,56B,106C 'attack':7A,48B,83C,95C 'bound':31B,74C,113C 'bypass':112C 'cab':4A,43B,89C,105C 'check':114C 'code':9A,63B,117C 'contain':25B,68C 'continu':88C 'corrupt':58B,84C 'craft':3A,39B,101C 'cve':12A,15A 'declar':91C 'decod':36B,80C 'desktop':20B 'enabl':115C 'entic':97C 'execut':61B,118C 'extract':11A,54B,100C 'get':50B 'heap':27B,70C 'let':6A,82C 'lzx':35B,79C 'memori':59B,85C 'multi':41B,103C 'multi-volum':40B,102C 'out-of-bound':28B,71C 'packag':21B 'pos':110C 'run':8A 'smaller':93C 'stale':109C 'trigger':46B 'valu':111C 'victim':52B,98C 'volum':42B,90C,104C 'vulner':76C 'window':22B,94C 'write':32B,75C 'zip':2A,19B,24B,65C","nicknames":[],"mitigations":[],"who_affected":"Anyone who extracts multi-volume CAB archives with a 7-Zip build older than 26.06. Exposure needs a user to open a crafted archive, so systems that never extract untrusted CAB files are at lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update 7-Zip to version 26.06 or later, and do not open CAB archives from people you do not trust until you have.","pkeys":[],"ptokens":[],"labels":["7zip","desktop","high","package","windows"],"campaign_type":null,"search_a":"'-125742':14A,17A '-2026':13A,16A '7':1A 'archiv':5A 'attack':7A 'cab':4A 'code':9A 'craft':3A 'cve':12A,15A 'extract':11A 'let':6A 'run':8A 'zip':2A","search_b":"'7':18B,23B 'arbitrari':62B 'archiv':44B,56B 'attack':48B 'bound':31B 'cab':43B 'code':63B 'contain':25B 'corrupt':58B 'craft':39B 'decod':36B 'desktop':20B 'execut':61B 'extract':54B 'get':50B 'heap':27B 'lzx':35B 'memori':59B 'multi':41B 'multi-volum':40B 'out-of-bound':28B 'packag':21B 'trigger':46B 'victim':52B 'volum':42B 'window':22B 'write':32B 'zip':19B,24B","search_c":"'26.06':67C '7':64C 'arbitrari':116C 'archiv':106C 'attack':83C,95C 'bound':74C,113C 'bypass':112C 'cab':89C,105C 'check':114C 'code':117C 'contain':68C 'continu':88C 'corrupt':84C 'craft':101C 'declar':91C 'decod':80C 'enabl':115C 'entic':97C 'execut':118C 'extract':100C 'heap':70C 'let':82C 'lzx':79C 'memori':85C 'multi':103C 'multi-volum':102C 'out-of-bound':71C 'pos':110C 'smaller':93C 'stale':109C 'valu':111C 'victim':98C 'volum':90C,104C 'vulner':76C 'window':94C 'write':75C 'zip':65C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T12:17:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125742","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125742","severity":null,"published_at":"2026-11-10T12:17:18+00:00","modified_at":"2026-11-10T12:17:19+00:00","first_seen_at":"2026-11-10T12:21:54+00:00","fetched_at":"2026-11-10T12:21:54+00:00","note":null}],"documents":[{"id":114870,"url":"https://github.com/ip7z/7zip/commit/d3296e39e1f1f92c7b41c0c3848e65640428d42d","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":114871,"url":"https://github.com/ip7z/7zip/releases/tag/26.06","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":114872,"url":"https://www.vulncheck.com/advisories/7-zip-before-26.06-heap-out-of-bounds-write-via-lzx-decoder-in-cab-extraction","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}