www.vulncheck.com High-Risk CVE-2026-125742 in 7-Zip Affects Users via CAB Extraction
Article Content
- •CVE-2026-125742 affects 7-Zip versions before 26.06.
- •Attackers can exploit the vulnerability via crafted CAB archives.
- •Users are urged to upgrade to the fixed release immediately.
A heap out-of-bounds write vulnerability (CVE-2026-125742) has been identified in 7-Zip versions before 26.06. This flaw allows attackers to exploit memory corruption when users extract specially crafted multi-volume CAB archives, potentially leading to arbitrary code execution. The vulnerability is classified as high severity with a CVSS score of 8.5. Users of Windows endpoints with 7-Zip installed, particularly those handling untrusted archives, are most at risk. Attackers may deliver malicious archives via email or downloads to gain control over the affected user's process. As of now, there is no confirmed active exploitation reported, but users are advised to upgrade to the patched version immediately. The vulnerability was published on November 10, 2026.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (4)
Following this threat?
Track CVE-2026-125742 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
What versions of 7-Zip are affected?
How can I mitigate this vulnerability?
Is there any active exploitation reported?
Continue Reading
Critical RCE Vulnerability in Confection WordPress Plugin (CVE-2026-115252) A critical vulnerability, CVE-2026-115252, has been identified in the Confection WordPress Cable plugin, affecting versions 0.4.0 to 0.4.7. This flaw allows unauthenticated attackers to execute arbitrary PHP code on the server by writing unmodified settings into a PHP file without proper checks. The vulnerability has…