{"schemaVersion":3,"id":"SUSE-SU-2026:22347-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Security update for 7zip\n\nThis update for 7zip fixes the following issues\n\nUpdate to 26.01:\n\n- CVE-2026-48092: Information disclosure in 32-bit builds due to heap memory disclosure (bsc#1267858).\n- CVE-2026-48095: Heap buffer overflow via NTFS compressed stream buffer under-allocation (bsc#1267421).\n- CVE-2026-48101: Information Disclosure via uninitialized memory in UEFI capsule parser (bsc#1267859).\n- CVE-2026-48102: Information disclosure and denial of service via crafted UDF image (bsc#1267860).\n- CVE-2026-48103: off-by-one heap out-of-bounds read (bsc#1267861).\n- CVE-2026-48104: Uninitialized heap read in SquashFS archive handler (bsc#1267862).\n- CVE-2026-48111: off-by-one out-of-bounds read in ParseDepedencyExpression function (bsc#1267863).\n- CVE-2026-48112: heap out-of-bounds read in BSD SYMDEF parser (bsc#1267864).\n\nChanges:\n\n * linux version of 7-Zip can use huge pages (2 MB pages). It can\n increase compression speed for 10% for 7z/xz/LZMA/LZMA2 compression.\n * new -spo[d|c|r] switch specifies the path generation mode for\n the output directory for archive extraction. The output directory\n path is generated from the path specified in the -o{dir_path}\n switch and the name of the archive being unpacked.\n -spod : for Linux/Posix/macOS: -o{dir_path} specifies the direct\n path to the output directory. The asterisk (*) character\n in {dir_path} will not be replaced by the archive name.\n -spoc : 7-Zip will concatenate the path specified in -o{dir_path}\n with the archive name to form the final path to the output\n directory.\n -spor : 7-Zip will replace asterisk (*) character in the path\n specified in the -o{dir_path} with the archive name.\n This is the default option.\n * some bugs were fixed.\n- Update to 26.00:\n * improved code for ZIP, CPIO, RAR, UFD, QCOW, Compound.\n * 7-Zip File Manager: improved sorting order of the file list.\n It uses file name as secondary sorting key.:\n * 7-Zip File Manager: improved Benchmark to support systems with more than\n 64 CPU threads.\n * bug fixed: 7-Zip could not correctly extract TAR archives containing sparse\n files","dates":{"published":"2026-06-23T12:43:00.000Z","modified":"2026-07-02T18:24:12.464Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"suse","product":"7zip&distro=SUSE Linux Enterprise Server 16.0","name":"7zip","label":"7zip&distro=SUSE Linux Enterprise Server 16.0","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/7zip&distro=SUSE Linux Enterprise Server 16.0","purlType":"rpm","versions":[{"text":"< 26.01-160000.1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 26.01-160000.1.1","eol":null,"hubHref":null},{"vendor":"suse","product":"7zip&distro=SUSE Linux Enterprise Server for SAP applications 16.0","name":"7zip","label":"7zip&distro=SUSE Linux Enterprise Server for SAP applications 16.0","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/7zip&distro=SUSE Linux Enterprise Server for SAP applications 16.0","purlType":"rpm","versions":[{"text":"< 26.01-160000.1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 26.01-160000.1.1","eol":null,"hubHref":null}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622347-1/","label":"www.suse.com/support/update/announcement/2026/suse-su-202622347-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1267421","label":"bugzilla.suse.com/1267421","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1267858","label":"bugzilla.suse.com/1267858","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1267859","label":"bugzilla.suse.com/1267859","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1267860","label":"bugzilla.suse.com/1267860","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1267861","label":"bugzilla.suse.com/1267861","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1267862","label":"bugzilla.suse.com/1267862","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1267863","label":"bugzilla.suse.com/1267863","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1267864","label":"bugzilla.suse.com/1267864","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48092","label":"www.suse.com/security/cve/CVE-2026-48092","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48095","label":"www.suse.com/security/cve/CVE-2026-48095","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48101","label":"www.suse.com/security/cve/CVE-2026-48101","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48102","label":"www.suse.com/security/cve/CVE-2026-48102","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48103","label":"www.suse.com/security/cve/CVE-2026-48103","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48104","label":"www.suse.com/security/cve/CVE-2026-48104","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48111","label":"www.suse.com/security/cve/CVE-2026-48111","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48112","label":"www.suse.com/security/cve/CVE-2026-48112","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2026-48092","CVE-2026-48095","CVE-2026-48101","CVE-2026-48102","CVE-2026-48103","CVE-2026-48104","CVE-2026-48111","CVE-2026-48112"],"downstream":[],"duplicates":[],"related":["CVE-2026-48092","CVE-2026-48095","CVE-2026-48101","CVE-2026-48102","CVE-2026-48103","CVE-2026-48104","CVE-2026-48111","CVE-2026-48112"]},"timeline":[{"kind":"published","date":"2026-06-23T12:43:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-07-02T18:24:12.464Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T01:47:47.897Z","stale":false,"partial":false}}