7-Zip (< 26.06) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/7-zip--26.06/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 10 Nov 2026 14:33:35 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svg7-Zip: LZX decoder heap out-of-bounds write (CVE-2026-125742)https://feed.craftedsignal.io/briefs/2026-11-09-7zip-heap-overflow/Tue, 10 Nov 2026 14:33:35 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-09-7zip-heap-overflow/7-Zip versions prior to 26.06 contain a heap out-of-bounds write vulnerability in the LZX decoder that can lead to arbitrary code execution when processing crafted multi-volume CAB archives.7-Zip versions before 26.06 are vulnerable to a heap out-of-bounds write vulnerability within the LZX decoder. The issue arises when the software processes multi-volume CAB archives where a continuation volume declares a smaller window size than the original. This discrepancy results in a stale _pos value that bypasses internal bounds checks, potentially allowing for arbitrary code execution if a user extracts a malicious CAB archive.

Impact

Successful exploitation allows for arbitrary code execution in the context of the user running the 7-Zip extraction process.

Recommendation

  • Update 7-Zip to version 26.06 or later across all managed endpoints to remediate CVE-2026-125742.
  • Restrict the opening of untrusted multi-volume CAB files until software updates are applied.
]]>highadvisory