Skip to main

Heap Buffer Write Overflow in 7-Zip bundled with PRI7000

BOSCH-SA-466086

Advisory Information

Summary

The GitHub Security Lab has discovered a vulnerability in 7-Zip 26.00 and older:

A heap buffer overflow vulnerability (GHSL-2026-140) exists in 7-Zip version 26.00, caused by an under-allocation in the NTFS compressed stream buffer (GetCuSize shift UB), potentially allowing attackers to exploit this issue for arbitrary code execution or application crashes.

(above excerpt from GHSL-2026-140: Heap Buffer Write Overflow in 7-Zip)

The vulnerable component 7-Zip is bundled in its portable version with the Bosch Rexroth AG software PRI7000. An attacker can exploit the vulnerable component by accessing it directly on the customer PC. The PRI7000 and its other components cannot be used to exploit the vulnerability indirectly.

Affected Products

  • Bosch Rexroth AG PRI7000
    • CVE-2026-48095
      • Version(s): all ≤ 1.11.18.1
      • cpe:2.3:a:boschrexroth:pri7000:1.11.18.1:*:*:*:*:*:*:*, up to (including): 1.11.18.1

Solution and Mitigations

Solution

Update to PRI7000 version 1.11.18.2 or newer, if possible.

Mitigation

  1. Navigate to the "Simulator" Folder typically installed on drive (C:)Windows - ProgramData - Bosch Rexroth AG - PRI7000_Data - V.1.11.XX.X - Common - Simulator
  2. In the Simulator folder you can choose three different releases of the PRI7000. The actual one and the two versions before.
  3. For each Version please navigate into the "7zip" folder V1.11.XX.X - App - Tools - 7zip
  4. Please delete the Folder "Far" in each of the three versions
  5. The vulnerable source code is deleted from the computer and can not affect the installed PRI7000 versions

Vulnerability Details

CVE-2026-48095

CVE Description: 7-Zip is a file archiver with a high compression ratio. Versions 26.00 and prior contain a heap buffer overflow vulnerability caused by an under-allocation in the NTFS compressed stream buffer (GetCuSize shift UB), potentially allowing attackers to cause arbitrary code execution or application crashes. CInStream::GetCuSize() in the NTFS handler computes the compression-unit buffer size as (UInt32)1 << (BlockSizeLog + CompressionUnit), and a crafted image with ClusterSizeLog >= 28 and CompressionUnit == 4 drives the exponent to 32, which is undefined behavior and collapses on x86/x64 so _inBuf is allocated as 1 byte. ReadStream_FALSE then writes up to 256 MB of attacker-controlled data into that 1-byte buffer in 64 KB iterations, and because the CInStream object sits only 304 bytes after _inBuf, its vtable pointer is overwritten and the next dispatched call achieves a vtable hijack. On 32-bit builds the overflow is unconditionally reached; on 64-bit it requires the parallel 8 GB _outBuf allocation to succeed, otherwise failing closed to denial of service. The NTFS handler is enabled by default in stock 7z.dll and, via signature-based fallback matching "NTFS " at offset 3, will open a crafted image regardless of file extension during extraction or testing. Version 26.01 fixes the issue.

Remarks

Security Update Information

With respect to Directive (EU) 2019/770 and Directive (EU) 2019/771 and their national transposition laws, please note:

It is your responsibility to download and/or install any security updates provided by us, for example to maintain product or data security. If you fail to install a security update provided to you within a reasonable period of time, we will not be liable for any product defect solely due to the absence of such security update.

Alternatively, we are entitled to directly download and/or install security updates regardless of your settings. In these cases, we will provide you with the relevant information, e.g. in this security advisory.

CVSS Scoring

Vulnerability classification has been performed using the CVSS v3.1 scoring system. The CVSS environmental score is specific to each customer's environment and should be defined by the customer to attain a final scoring.

Additional Resources

Revision History

  • 22 Jul 2026: Initial Publication