Critical Vulnerability in 7zip and p7zip Packages: CVE-2026-48095
Summary
DEBIAN-CVE-2026-48095: ... Affects 7zip versions 22.01+dfsg-10~exp1 – 26.01+dfsg-2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
7zip and p7zip are widely used open-source file archivers that support various compression formats. They are known for their high compression ratios and ability to handle large files. This vulnerability affects multiple versions of these packages across different Debian distributions, potentially exposing users to security risks.
Vulnerability Detail
CVE-2026-48095 is a critical vulnerability that affects the 7zip and p7zip packages in Debian ecosystems. The vulnerability originates from improper handling of certain file formats, which could allow an attacker to execute arbitrary code or cause a denial of service. The affected versions do not have adequate checks in place, making them susceptible to exploitation through crafted archive files.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate patching is not feasible, consider temporarily disabling the use of 7zip and p7zip for untrusted files or archives until the packages can be updated. Additionally, ensure that your system has appropriate security measures in place, such as firewalls and intrusion detection systems.
Conclusion
CVE-2026-48095 poses a significant risk to users of the 7zip and p7zip packages in various Debian distributions. It is crucial to update to the patched versions to mitigate this vulnerability and protect your system from potential attacks.
See every vulnerability recorded for 7zip →
FAQ
CVE-2026-48095 is a vulnerability affecting the 7zip and p7zip packages in Debian, which could allow attackers to execute arbitrary code.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Consider disabling the use of 7zip and p7zip for untrusted files and ensure your system has adequate security measures in place.
While specific exploits may not be publicly available, the nature of the vulnerability suggests that crafted archive files could be used to exploit affected systems.
More information can be found in the official Debian security advisories and on the Vulert website.
References
Related vulnerabilities
Recent vulnerabilities recorded for 7zip.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
