v26.02 - Vulnerability severity?

[gary-palmer]

Apologies if I've missed it, but the release notes say "some vulnerabilities fixed", are there any details? or at the least, what the severity of the vulnerabilities are?

https://github.com/ip7z/7zip/releases/tag/26.02

thanks,

[AScott-WWF]

I'm wondering if CVE-2026-58052 is actually fixed in 26.02 and therefore the published CVE detail is incorrect (https://nvd.nist.gov/vuln/detail/CVE-2026-58052) or if it is not fixes, when this Low severity (CVSS v3 3.3) flaw will be fixed?

[cfi-gb]

Seems to be unfixed: #235

[SelfMan]

The CVE.org has a different info.
https://www.cve.org/CVERecord?id=CVE-2026-58052
https://www.vulncheck.com/advisories/7-zip-mark-of-the-web-bypass-via-rar5-alternate-data-stream-name-collision
In general, the available information is inconsistent and unclear.
Though there seems to be some activity in the mentioned #235 thread now.

[cfi-gb]

The CVE.org has a different info.
https://www.cve.org/CVERecord?id=CVE-2026-58052
https://www.vulncheck.com/advisories/7-zip-mark-of-the-web-bypass-via-rar5-alternate-data-stream-name-collision
In general, the available information is inconsistent and unclear.

Nothing unusual here, the CVE description or external advisories are regularly outdated / not reliable concerning affected or fixed versions.

[SelfMan]

The NVD page has got some updates, yet the information is still inconclusive.
https://nvd.nist.gov/vuln/detail/CVE-2026-58052
I wrote them about the inconsistency. We'll see what happens.