CVE-2026-125742
Awaiting Analysis Awaiting Analysis - Queue

Heap Out-of-Bounds Write in 7-Zip LZX Decoder

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: VulnCheck

Description
7-Zip before 26.06 contains a heap out-of-bounds write vulnerability in the LZX decoder that lets attackers corrupt memory when a continuation CAB volume declares a smaller window. Attackers can entice victims to extract crafted multi-volume CAB archives, where a stale _pos value bypasses bounds checks, enabling arbitrary code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-125742
EUVD
EUVD-2026-120897

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
7-Zip 7-Zip From 0 (inc) to 26.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a heap out-of-bounds write flaw in 7-Zip's LZX decoder used for extracting CAB archives. It occurs when processing crafted multi-volume CAB files where a continuation volume declares a smaller window size. A stale _pos value bypasses bounds checks, allowing attackers to corrupt memory and potentially execute arbitrary code.

Detection Guidance

Check the installed version of 7-Zip on your system. If it is below 26.06, the system is vulnerable. Use commands like '7z' or '7zz' to verify the version. Monitor network traffic for unusual CAB archive extraction activities.

Impact Analysis

Attackers can exploit this to execute arbitrary code on your system by tricking you into extracting a specially crafted multi-volume CAB archive. This could lead to full system compromise, data theft, or installation of malware. The exploit works without requiring user interaction beyond extracting the archive.

Mitigation Strategies

Update 7-Zip to version 26.06 or later immediately. Avoid extracting untrusted multi-volume CAB archives until patched. Implement network monitoring to detect exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-125742. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...