{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/7-zip--26.06/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:7-zip:7-zip:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-125742"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["7-Zip (\u003c 26.06)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["7-Zip"],"content_html":"\u003cp\u003e7-Zip versions before 26.06 are vulnerable to a heap out-of-bounds write vulnerability within the LZX decoder. The issue arises when the software processes multi-volume CAB archives where a continuation volume declares a smaller window size than the original. This discrepancy results in a stale _pos value that bypasses internal bounds checks, potentially allowing for arbitrary code execution if a user extracts a malicious CAB archive.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary code execution in the context of the user running the 7-Zip extraction process.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate 7-Zip to version 26.06 or later across all managed endpoints to remediate CVE-2026-125742.\u003c/li\u003e\n\u003cli\u003eRestrict the opening of untrusted multi-volume CAB files until software updates are applied.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-10T14:33:35Z","date_published":"2026-11-10T14:33:35Z","id":"https://feed.craftedsignal.io/briefs/2026-11-09-7zip-heap-overflow/","summary":"7-Zip versions prior to 26.06 contain a heap out-of-bounds write vulnerability in the LZX decoder that can lead to arbitrary code execution when processing crafted multi-volume CAB archives.","title":"7-Zip: LZX decoder heap out-of-bounds write (CVE-2026-125742)","url":"https://feed.craftedsignal.io/briefs/2026-11-09-7zip-heap-overflow/"}],"language":"en","title":"CraftedSignal Threat Feed - 7-Zip (\u003c 26.06)","version":"https://jsonfeed.org/version/1.1"}