Heap Out-of-Bounds Write Vulnerability in 7-Zip by Igor Pavlov
CVE-2026-125742

8.5HIGH

Key Information:

Vendor

7-zip
Status
7-zip
Vendor
CVE Published:
10 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-125742?

A heap out-of-bounds write vulnerability exists in 7-Zip prior to version 26.06, specifically in the LZX decoder when handling multi-volume CAB archives. This vulnerability allows attackers to exploit a condition where a continuation CAB volume is declared with a smaller window, leading to memory corruption. When users extract specially crafted archives, a stale position value bypasses necessary bounds checks, potentially enabling the execution of arbitrary code. This presents significant risks to users who unknowingly extract manipulated files.

Affected Version(s)

7-Zip 0 < 26.06

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-125742 - Proof of Concept

References

https://github.com/ip7z/7zip/commit/d3296e39e1f1f92c7b41c...
patch
https://github.com/ip7z/7zip/releases/tag/26.06
release-notes
https://github.com/ip7z/7zip/blob/26.05/CPP/7zip/Compress...
product

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nguyễn Trần Thanh Lâm
.