CVE-2026-45384

MediumCVSS 6.1

Published: 10/06/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

3th percentile - higher than 3% of all known CVEs

Summary

The bit7z library prior to version 4.0.12 has an arbitrary file overwrite vulnerability via symlink attack on predictable temp files during archive update.

Risk Assessment

An attacker can overwrite arbitrary files on the system by exploiting predictable temporary file names, potentially leading to privilege escalation or data corruption.

Recommendation

Upgrade the bit7z library to version 4.0.12, which contains the fix for this vulnerability.

Other vulnerabilities in bit7z

CVE-2026-45380Low
Vulnerability in bit7z library before version 4.0.12 causes an off-by-one error in SafeOutPathBuilder::restoreSymlink(), allowing a crafted .7z archive to create a symlink outside the intended output directory on non-Windows platforms, enabling arbitrary file writes.

Original NVD description (English source)

bit7z is a cross-platform C++ static library that allows the compression/extraction of archive files. Prior to version 4.0.12, there is an arbitrary file overwrite vulnerability via symlink attack on predictable temp files during archive update. This issue has been patched in version 4.0.12.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS