CVE-2026-45384
bit7z is a cross-platform C++ static library that allows the compression/extraction of archive files. Prior to version 4.0.12, there is an arbitrary file overwrite vulnerability via symlink attack on predictable temp files during archive update. This issue has been patched in version 4.0.12.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.1
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
- EPSS probability
- 0.13%
- CWE
- CWE-59, CWE-377
- Published
- 2026-06-10
- Last modified
- 2026-06-11
Affected products
- rikyoz bit7z
Weakness type
Related vulnerabilities
- CVE-2026-87766 — Bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup
- CVE-2026-78622 — Improper Link Resolution in Okta Verify for Windows Uninstaller Data Removal
- CVE-2026-81963 — Windows Update Stack Elevation of Privilege Vulnerability
- CVE-2026-69425 — Windows NTFS Tampering Vulnerability
- CVE-2026-69289 — Windows Setup Files Cleanup Elevation of Privilege Vulnerability
- CVE-2026-83999 — Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability
- CVE-2026-70563 — Windows Shell Spoofing Vulnerability
- CVE-2026-69771 — Windows Container Manager Service Security Feature Bypass Vulnerability