Read the docs
TI-2026-74073 Aliases CVE-2026-104086GHSA-xhq8-p89q-r47c

Uninitialized memory disclosure in 7-Zip SquashFS archive handler

Priority LOW 29CWE-908Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-908 and the CVSS impact.

Summary

7-Zip before 26.03 contains an uninitialized memory disclosure flaw in its SquashFS v4 archive handler, where a crafted archive can make the superblock's no_ids field miscompute the final metadata block's expected size and bypass the size check. An attacker who supplies a malicious archive that a user lists or extracts can cause 7-Zip to return uninitialized heap memory as user and group ID properties, exposing potentially sensitive process memory contents (CWE-908). The CVSS 4.0 vector indicates a local attack that requires user interaction and results in high confidentiality impact on the vulnerable system.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

7-Zip before 26.03 contains an uninitialized memory disclosure vulnerability in the SquashFS v4 archive handler (SquashfsHandler.cpp) that allows attackers to leak heap memory by crafting a malicious archive where the superblock’s no_ids field is set so that the final metadata block’s expected size is miscomputed and bypasses the size validation check. By listing or extracting the crafted archive, attackers can cause the application to return uninitialized heap memory as the kpidUserId and kpidGroupId properties, exposing potentially sensitive process memory contents to the user.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00186 8th percentileScored 2026-11-07
Fix Fixed 7-Zip (7-Zip): 26.03

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
7-Zip7-Zipbefore 26.0326.03Patch availableCNA
  • 7-Zip Vendor7-Zip Affected before 26.03 Fixed in 26.03 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:7-zip:7-zip:*:*:*:*:*:*:*:*——7-Zip
  • cpe:2.3:a:7-zip:7-zip:*:*:*:*:*:*:*:* Versions — — ·7-Zip

Remediation

Update 7-Zip to version 26.03 or later, which fixes the issue. The sources list no other fixed versions for 7-Zip.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA 7-Zip (7-Zip) Fixed in 26.03

Timeline

  1. 2026-10-14 Threatist record created from CVE-2026-104086
  2. 2026-10-14 Alias added: GHSA-xhq8-p89q-r47c
  3. 2026-10-16 Priority changed: MEDIUM → LOW
  4. 2026-10-20 CISA SSVC decision points changed

References

Patch 1

Other 1

  • TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
  • TI-2025-00330 Protection mechanism failure in 7-Zip KEVCVSS 3.1HIGH 7.0
  • TI-2026-35535 GHSL-2026-140_7-Zip: 7-Zip has a heap buffer overflow via NTFS compressed stream buffer under-allocation CVSS 3.1HIGH 8.8
  • TI-2024-10630 Integer underflow in 7-Zip CVSS 3.1HIGH 7.8
  • TI-2023-14827 Ppmd7.c in 7-Zip before 23.00 allows an integer underflow and invalid read operation via a crafted 7Z archive. CVSS 3.1HIGH 7.8
  • TI-2022-23297 p7zip 16.02 was discovered to contain a heap-buffer-overflow vulnerability via the… CVSS 3.1HIGH 7.8
See all 36 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences