CVE-2026-45384

EUVD-2026-36115
bit7z is a cross-platform C++ static library that allows the compression/extraction of archive files. Prior to version 4.0.12, there is an arbitrary file overwrite vulnerability via symlink attack on predictable temp files during archive update. This issue has been patched in version 4.0.12.
Link Following
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
GitHub_MCNA
6.1 MEDIUM
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 2%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
rikyozbit7z
𝑥
< 4.0.12
CNA
Common Weakness Enumeration
References
https://github.com/rikyoz/bit7z/releases/tag/v4.0.12
https://github.com/rikyoz/bit7z/security/advisories/GHSA-wjch-42rm-q53h
https://github.com/rikyoz/bit7z/security/advisories/GHSA-wjch-42rm-q53h