ECHO-c41c-0d0a-92ad
See a problem?- Import Source
- https://advisory.echohq.com/osv/ECHO-c41c-0d0a-92ad.json
- JSON Data
- https://api.osv.dev/v1/vulns/ECHO-c41c-0d0a-92ad
- Upstream
- Withdrawn
- 2026-07-19T16:41:19Z
- Published
- 2026-07-06T14:55:23Z
- Modified
- 2026-09-15T03:33:36Z
- Summary
- Low-severity (CVSS 3.1 2.5, CWE-754, Debian "unimportant") error-reporting quirk: 7-Zip 22.01 silently returns OK for an xz file with reserved bits set in the stream flags instead of flagging it. No memory-safety impact. NVD's affected-version data is pinned to exactly 22.01 and states "Some later versions are unaffected"; remediated upstream by version currency, not by a separate patch, so there is nothing to backport. Verified against the reporter's PoC (boofish/semantic-bugs pocs/poc2.xz) on this build's 25.01 binaries: the standalone 7za/7zr hard-error (exit 2, "Is not archive") and 7zz/7z no longer silently accept it (now emit "Warnings: 1"), so the reported silent-acceptance behavior does not reproduce.
- Details
- References