v26.02 - Vulnerability severity?

[gary-palmer]

Apologies if I've missed it, but the release notes say "some vulnerabilities fixed", are there any details? or at the least, what the severity of the vulnerabilities are?

https://github.com/ip7z/7zip/releases/tag/26.02

thanks,

[AScott-WWF]

I'm wondering if CVE-2026-58052 is actually fixed in 26.02 and therefore the published CVE detail is incorrect (https://nvd.nist.gov/vuln/detail/CVE-2026-58052) or if it is not fixes, when this Low severity (CVSS v3 3.3) flaw will be fixed?

[cfi-gb]

Seems to be unfixed: #235

[SelfMan]

The CVE.org has a different info.
https://www.cve.org/CVERecord?id=CVE-2026-58052
https://www.vulncheck.com/advisories/7-zip-mark-of-the-web-bypass-via-rar5-alternate-data-stream-name-collision
In general, the available information is inconsistent and unclear.
Though there seems to be some activity in the mentioned #235 thread now.

[cfi-gb]

The CVE.org has a different info.
https://www.cve.org/CVERecord?id=CVE-2026-58052
https://www.vulncheck.com/advisories/7-zip-mark-of-the-web-bypass-via-rar5-alternate-data-stream-name-collision
In general, the available information is inconsistent and unclear.

Nothing unusual here, the CVE description or external advisories are regularly outdated / not reliable concerning affected or fixed versions.

[SelfMan]

The NVD page has got some updates, yet the information is still inconclusive.
https://nvd.nist.gov/vuln/detail/CVE-2026-58052
I wrote them about the inconsistency. We'll see what happens.

[AtomicFizzle]

Any updates? Nothing seems to have changed in the last month. The inconsistencies on affected versions between sources (GitHub, NIST, DISA, VulnCheck, etc.) is still causing confusion. Or, worst case, there is still an unpatched vulnerability in the latest release?

[SelfMan]

If you checked NIST you would see:

Same on CVE.org So, if you are on 26.02, you are ok.

[AtomicFizzle]

Tracking. And I actually asked NIST to update that, to match the description text there. But in requesting Tenable to update their associated Nessus plug-in, they declined - citing #235 and a lack of explicit closure of CVE-2026-58052 in the v26.02 changelog.