{"id":"CVE-2016-9296","details":"A null pointer dereference bug affects the 16.02 and many old versions of p7zip. A lack of null pointer check for the variable folders.PackPositions in function CInArchive::ReadAndDecodePackedStreams in CPP/7zip/Archive/7z/7zIn.cpp, as used in the 7z.so library and in 7z applications, will cause a crash and a denial of service when decoding malformed 7z files.","modified":"2026-03-12T22:27:02.466590Z","published":"2016-11-12T02:59:04.650Z","related":["openSUSE-SU-2024:10322-1"],"references":[{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/94294"},{"type":"REPORT","url":"https://sourceforge.net/p/p7zip/bugs/185/"},{"type":"FIX","url":"https://github.com/yangke/7zip-null-pointer-dereference"},{"type":"EVIDENCE","url":"https://sourceforge.net/p/p7zip/discussion/383043/thread/648d34db/"}],"affected":[{"database_specific":{"unresolved_ranges":[{"events":[{"introduced":"0"},{"last_affected":"16.02"}]}],"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-9296.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}