Uninitialized Memory Disclosure Vulnerability in 7-Zip by 7-Zip

CVE-2026-104086

What is CVE-2026-104086?

The vulnerability in 7-Zip prior to version 26.03 allows an attacker to exploit an uninitialized memory disclosure through a specially crafted SquashFS archive. By manipulating the archive's superblock's no_ids field, the application miscalculates the expected size of the final metadata block, bypassing crucial size validation checks. This could lead to the disclosure of sensitive process memory contents, as attackers are able to access uninitialized heap memory through properties like kpidUserId and kpidGroupId. Proper caution should be taken when listing or extracting such malicious archives to mitigate risks.

References