CVE Alert: CVE-2026-125742 – 7-Zip – 7

7-Zip before 26.06 contains a heap out-of-bounds write vulnerability in the LZX decoder that lets attackers corrupt memory when a continuation CAB volume declares a smaller window. Attackers can entice victims to extract crafted multi-volume CAB archives, where a stale _pos value bypasses bounds checks, enabling arbitrary code execution.

This is a high-impact, user-assisted endpoint risk; urgency cannot be ranked against active exploitation because KEV, SSVC and EPSS data were not supplied.

Successful exploitation could give an attacker control of the affected user’s 7-Zip process, risking data theft, file tampering or disruption. A likely goal is to turn a convincing archive delivered through email, messaging or a download into a foothold on a workstation.

### Most likely attack path

An attacker supplies a crafted multi-volume CAB archive and persuades a user to open or extract it. The attack is local, requires no existing privileges and has low stated complexity, but depends on user interaction; the stated scope is unchanged, so cross-boundary impact is not indicated.

### Who is most exposed

Prioritise Windows endpoints where 7-Zip is installed and users regularly handle archives from external or untrusted sources, including support, finance and software teams.

Review endpoint telemetry for 7-Zip launching after archive downloads or email attachments.

Look for unusual child processes, crashes or memory-access alerts associated with archive extraction.

Correlate multi-volume CAB files with suspicious downloads and subsequent file or process activity.

Check application inventory and software deployment records to identify affected installations.

### Mitigation and prioritisation

Upgrade to the vendor’s fixed release; prioritise internet-facing workflows and high-risk users first.

Until patched, block or quarantine untrusted CAB archives and restrict extraction from email and browser download locations.

Use endpoint controls to limit unexpected child processes from archive utilities.

Validate the KEV, SSVC, EPSS and PoC status before final triage; an exploit-tagged reference alone does not confirm in-the-wild use.

Test the update on representative endpoints, then deploy promptly through normal change controls.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.