# 7-Zip: crafted CAB extraction can lead to code execution Canonical: https://www.oktsec.com/radar/7zip-cab-lzx-cve-2026-125742 Publisher: Oktsec Language: en Published: 2026-11-12T23:07:39Z Updated: 2026-11-12T23:07:39Z Record reviewed: 2026-11-12T23:07:39Z Latest evidence check: 2026-11-12T23:07:39Z Disclosed: 2026-11-10 The CNA reports memory corruption in CAB extraction before 7-Zip 26.06. Processing a crafted archive is required; the reviewed record does not establish attacks against users. ## Evidence and response priority - Category: Vulnerability - Oktsec priority: Review this week - Rationale: Crafted CAB extraction is required and 26.06 is available. Prioritize copies that process untrusted archives; actual attacks are not established by the reviewed sources. - Evidence: Attacks not established - Verification: Vendor confirmed - Fix status: Fix available - Exposure requirement: Application or configuration dependent - Vendor: 7-Zip - Products: 7-Zip - CVEs: CVE-2026-125742 ## Technical overview CVE-2026-125742 affects the LZX decoder in 7-Zip before 26.06. A continuation volume with a smaller window can cause a write outside the allocated buffer during extraction and lead to code execution. The CNA record requires the victim to extract a crafted CAB archive with multiple volumes. Receiving an attachment alone does not establish exploitation. The record includes CISA enrichment marking a proof of concept; this is not confirmation of actual attacks. The project published 26.06 on November 7. The CNA identifies it as the corrected version and was published November 10; those are separate dates. Oktsec recommends checking portable installations and scripts that invoke their own copy of the extractor. Until the relevant copy is corrected, hold untrusted CAB processing. After updating, verify the binary that scheduled jobs actually execute. ## Recommended response Update deployed 7-Zip copies to 26.06 or a later corrected release. Verify portable copies and archive processing jobs before resuming untrusted CAB extraction. Relevant to: Endpoint administrators and teams processing CAB archives on workstations, servers or build systems. ## CVE attribution - CVE-2026-125742: 7-Zip — 7-Zip. [Source](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125742.json) ## Affected systems and fixes ### 7-Zip Affected: Versions before 26.06 when extracting specially crafted CAB archives with multiple volumes. Fixed release / action: 26.06 Confirm the running version against the vendor advisory, including any distribution backports. ## CISA KEV evidence Catalog: 2026.11.10 Checked: 2026-11-13T01:29:19.779Z No matching CVE appears in the reviewed catalog snapshot. CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America. ## Supporting evidence Snapshot checked: 2026-11-13T01:30:03.234Z. These dates do not change the incident’s editorial review date. ### FIRST EPSS forecast - [CVE-2026-125742](https://api.first.org/data/v1/epss?cve=CVE-2026-125742): 0.18% probability of observed exploitation in the next 30 days; percentile 7.57%; score date 2026-11-12. EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-11-13T01:30:03.234Z. ### Official regional advisories - [Vulnerabilidad en productos 7-Zip](https://www.cert.gov.py/vulnerabilidad-en-productos-7-zip-2/) — CERT-PY, Paraguay; publication 2026-11-12T12:56:16.000Z; observed 2026-11-13T01:30:03.234Z; matched by exact CVE identifier. Publisher country does not establish victim location. Original notices may repeat the same underlying advisory. ## Response checklist 1. **Find the extractor actually in use** — Oktsec recommends checking installed, portable and bundled copies, plus scripts and scheduled archive jobs. 2. **Replace affected copies** — Install 26.06 or a later corrected release from the project or verify a distributor backport explicitly covering this CVE. 3. **Check resumed archive processing** — Oktsec recommends verifying the deployed binary and running version before resuming untrusted CAB processing. An installer result does not verify every copy. ## Relevance to AI environments Oktsec recommends checking the extractor invoked by agents or automated jobs that download and unpack archives. A corrected interactive installation does not protect a job using a separate vulnerable binary. ## Sources - [CNA record: CAB LZX decoder vulnerability](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125742.json) — VulnCheck; Research report; checked 2026-11-12T23:03:49Z - [7-Zip 26.06 release](https://github.com/ip7z/7zip/releases/tag/26.06) — 7-Zip; Vendor notice; checked 2026-11-12T23:06:28Z ## Editorial record - 2026-11-12T23:07:39Z: Added verified prerequisites, affected versions, correction scope and operational checks. Actual attacks are not established by the reviewed sources. ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/7zip-cab-lzx-cve-2026-125742) · [Build a response plan](https://www.oktsec.com/radar/7zip-cab-lzx-cve-2026-125742#review-workspace) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=7zip-cab-lzx-cve-2026-125742&service=exposure_check) - [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=7zip-cab-lzx-cve-2026-125742&service=patch_verification) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.