7-Zip NTFS archive handler heap buffer overflow

#!/usr/bin/env python3
# CVE-2026-48095 checker for 7-Zip / 7zz / packaged 7zip
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys

TARGET_FIXED = (26, 1)

def run(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True, timeout=10)
        return p.returncode, p.stdout.strip()
    except Exception:
        return 999, ""

def parse_version(text):
    if not text:
        return None
    # Prefer upstream-looking versions such as 26.01, 25.01, 22.01
    m = re.search(r'(?:^|[^0-9])((\d{2})\.(\d{2}))(?:[^0-9]|$)', text)
    if m:
        return (int(m.group(2)), int(m.group(3)), m.group(1))
    # Debian backport patterns like really25.01
    m = re.search(r'really(\d{2})\.(\d{2})', text)
    if m:
        return (int(m.group(1)), int(m.group(2)), f"{m.group(1)}.{m.group(2)}")
    return None

def version_status(ver):
    if ver is None:
        return "UNKNOWN"
    major, minor, _ = ver
    if (major, minor) >= TARGET_FIXED:
        return "PATCHED"
    return "VULNERABLE"

def check_binary(path):
    for args in ([path], [path, '--help'], [path, '-h'], [path, 'i']):
        rc, out = run(args)
        ver = parse_version(out)
        if ver:
            return version_status(ver), f"binary={path} version={ver[2]}"
    return None, None

def windows_candidates():
    candidates = []
    envs = [os.environ.get('ProgramFiles'), os.environ.get('ProgramFiles(x86)'), os.environ.get('ChocolateyInstall')]
    for base in envs:
        if not base:
            continue
        candidates.extend([
            os.path.join(base, '7-Zip', '7z.exe'),
            os.path.join(base, '7-Zip', '7zFM.exe'),
            os.path.join(base, 'bin', '7z.exe'),
        ])
    for name in ['7z.exe', '7zz.exe', '7z', '7zz']:
        p = shutil.which(name)
        if p:
            candidates.append(p)
    seen = set()
    uniq = []
    for c in candidates:
        if c and c not in seen:
            uniq.append(c)
            seen.add(c)
    return uniq

def unix_candidates():
    candidates = []
    for name in ['7zz', '7z']:
        p = shutil.which(name)
        if p:
            candidates.append(p)
    return candidates

def check_packages_linux():
    # dpkg / apt
    if shutil.which('dpkg-query'):
        rc, out = run(['dpkg-query', '-W', '-f=${Package} ${Version}\n', '7zip', 'p7zip'])
        if out:
            lines = [x.strip() for x in out.splitlines() if x.strip() and 'no packages found' not in x.lower()]
            for line in lines:
                ver = parse_version(line)
                if ver:
                    return version_status(ver), f"package={line}"
    # rpm
    if shutil.which('rpm'):
        for pkg in ['7zip', 'p7zip']:
            rc, out = run(['rpm', '-q', pkg])
            if rc == 0 and out:
                ver = parse_version(out)
                if ver:
                    return version_status(ver), f"package={out}"
    # apk
    if shutil.which('apk'):
        rc, out = run(['apk', 'info', '-e', '7zip'])
        if rc == 0:
            rc2, out2 = run(['apk', 'info', '-v', '7zip'])
            ver = parse_version(out2)
            if ver:
                return version_status(ver), f"package={out2}"
    return None, None

def main():
    system = platform.system().lower()

    if 'windows' in system:
        for path in windows_candidates():
            if os.path.exists(path):
                status, detail = check_binary(path)
                if status:
                    print(f"{status}: {detail}")
                    sys.exit(0 if status == 'PATCHED' else 1)
        print('UNKNOWN: 7-Zip binary not found or version could not be parsed')
        sys.exit(2)

    # Linux / macOS / other Unix-like
    status, detail = check_packages_linux()
    if status:
        print(f"{status}: {detail}")
        sys.exit(0 if status == 'PATCHED' else 1)

    for path in unix_candidates():
        status, detail = check_binary(path)
        if status:
            print(f"{status}: {detail}")
            sys.exit(0 if status == 'PATCHED' else 1)

    print('UNKNOWN: no supported 7-Zip installation located or version string unparseable')
    sys.exit(2)

if __name__ == '__main__':
    main()