{"document":{"category":"csaf_vex","csaf_version":"2.0","distribution":{"text":"Copyright © Red Hat, Inc. All rights reserved.","tlp":{"label":"WHITE","url":"https://www.first.org/tlp/"}},"lang":"en","notes":[{"category":"legal_disclaimer","text":"This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.","title":"Terms of Use"}],"publisher":{"category":"vendor","contact_details":"https://access.redhat.com/security/team/contact/","issuing_authority":"Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.","name":"Red Hat Product Security","namespace":"https://www.redhat.com"},"references":[{"category":"self","summary":"Canonical URL","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48103.json"}],"title":"7-Zip: off-by-one heap-based buffer over-read in the WIM archive handler","tracking":{"current_release_date":"2026-06-28T12:05:14+00:00","generator":{"date":"2026-06-28T12:05:14+00:00","engine":{"name":"Red Hat SDEngine","version":"5.2.6"}},"id":"CVE-2026-48103","initial_release_date":"2026-06-05T15:48:49.891000+00:00","revision_history":[{"date":"2026-06-05T15:48:49.891000+00:00","number":"1","summary":"Initial version"},{"date":"2026-06-10T13:57:18+00:00","number":"2","summary":"Current version"},{"date":"2026-06-28T12:05:14+00:00","number":"3","summary":"Last generated version"}],"status":"final","version":"3"}},"product_tree":{"branches":[{"category":"vendor","name":"Red Hat","product":{"name":"All currently supported Red Hat products","product_id":"red_hat_products","product_identification_helper":{"cpe":"cpe:/a:redhat"}}}]},"vulnerabilities":[{"cve":"CVE-2026-48103","discovery_date":"2026-06-05T17:01:18.674808+00:00","flags":[{"label":"vulnerable_code_not_present","product_ids":["red_hat_products"]}],"notes":[{"category":"description","text":"7-Zip is a file archiver with a high compression ratio. Versions 9.34 through 26.00 contain an off-by-one heap out-of-bounds read in the WIM (Windows Imaging) archive handler's security descriptor lookup. In CHandler::GetSecurity (CPP/7zip/Archive/Wim/WimHandler.cpp), the per-image SecurOffsets table holds numEntries + 1 cumulative offsets, but the check securityId >= SecurOffsets.Size() admits securityId == numEntries, and the function then reads SecurOffsets[securityId + 1], fetching one UInt32 past the end of the heap-allocated CRecordVector (which performs no bounds checking on operator[]). The securityId is attacker-controlled at offset +0xC of any directory entry in WIM metadata, and the handler is registered for .wim, .swm, .esd, and .ppkg and enabled by default in stock 7z.dll; the OOB triggers zero-click in the GUI because 7zFM.exe's ListView calls GetRawProp(kpidNtSecure) for every item during listing (ASan-confirmed), and is also reachable via CLI listing with 7zz l -slt. Impact is limited to denial of service under hardened allocators and minor information disclosure, since the OOB value is only consumed arithmetically as a length and is not surfaced to the attacker; there is no write primitive.","title":"Vulnerability description"},{"category":"other","text":"Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.","title":"Statement"},{"category":"general","text":"The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.","title":"CVSS score applicability"}],"product_status":{"known_not_affected":["red_hat_products"]},"references":[{"category":"self","summary":"Canonical URL","url":"https://access.redhat.com/security/cve/CVE-2026-48103"},{"category":"external","summary":"https://www.cve.org/CVERecord?id=CVE-2026-48103","url":"https://www.cve.org/CVERecord?id=CVE-2026-48103"}],"release_date":"2026-06-05T15:48:49.891000+00:00","scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","version":"3.1"},"products":["red_hat_products"]}],"title":"7-Zip: off-by-one heap-based buffer over-read in the WIM archive handler"}]}