A one‑byte off‑by‑one error in bit7z’s SafeOutPathBuilder::restoreSymlink() allows a malicious .7z archive to forge a symlink that escapes the intended extraction directory. When the archive is extracted on non‑Windows platforms, subsequent entries written through that symlink can create or overwrite arbitrary files with the permissions of the extracting process, enabling a compromise of confidentiality and integrity.

The affected product is rikyoz:bit7z. All non‑Windows installations running any version prior to 4.0.12 are susceptible, while version 4.0.12 and later contain the fix.

The CVSS score of 3.6 indicates moderate severity and the EPSS score is not reported, suggesting limited publicly available exploitation data. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is local: an attacker who can supply an archive and trigger extraction on a vulnerable system can force the creation of files outside the intended directory.