CVE-2026-104086: 7-Zip < 26.03 SquashFS Uninitialized Memory Disclosure via UID/GID Table
7-Zip before 26.03 contains an uninitialized memory disclosure vulnerability in the SquashFS v4 archive handler (SquashfsHandler.cpp) that allows attackers to leak heap memory by crafting a malicious archive where the superblock’s noids field is set so that the final metadata block’s expected size is miscomputed and bypasses the size validation check. By listing or extracting the crafted archive, attackers can cause the application to return uninitialized heap memory as the kpidUserId and kpidGroupId properties, exposing potentially sensitive process memory contents to the user.
Affected Software
Event History
Frequently Asked Questions
Which 7-Zip versions are affected?
7-Zip versions before 26.03 are affected.
What user action triggers the disclosure?
Listing or extracting a crafted SquashFS v4 archive can trigger the issue. The attacker must provide a malicious archive for the user to process.
What data can be exposed?
The application can return uninitialized heap memory through the kpidUserId and kpidGroupId properties, potentially disclosing sensitive memory contents from the 7-Zip process.