CVE-2026-104086
7-Zip < 26.03 SquashFS Uninitialized Memory Disclosure via UID/GID Table
- State
- Published
- Severity
- 6.8 Medium
- Published
- Oct 14, 2026
- Updated
- Oct 19, 2026
- Reserved
- Oct 1, 2026
Description
7-Zip before 26.03 contains an uninitialized memory disclosure vulnerability in the SquashFS v4 archive handler (SquashfsHandler.cpp) that allows attackers to leak heap memory by crafting a malicious archive where the superblock’s no_ids field is set so that the final metadata block’s expected size is miscomputed and bypasses the size validation check. By listing or extracting the crafted archive, attackers can cause the application to return uninitialized heap memory as the kpidUserId and kpidGroupId properties, exposing potentially sensitive process memory contents to the user.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.8 Medium | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 5.5 Medium | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-908 Use of Uninitialized Resource
Affected Products
| Product | Versions |
|---|---|
7-Zip7-Zip |
|
References
- Fixed Releaserelease-notespatch
- Project Webpageproduct
- VulnCheck Advisory: 7-Zip < 26.03 SquashFS Uninitialized Memory Disclosure via UID/GID Tablethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.