EUVD-2026-34837Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
7-Zip is a file archiver with a high compression ratio. Versions 9.34 through 26.00 contain a heap memory disclosure via SquashFS fragment offset integer overflow on 32-bit builds. 32-bit integer overflow in the SquashFS ReadBlock function allows an attacker-controlled node.Offset value to bypass the fragment bounds check, causing memcpy to read heap memory preceding the cache buffer into the extracted file. The vulnerability is exploitable only on 32-bit builds of 7-Zip where size_t is 32 bits, allowing the addition offsetInBlock + blockSize to wrap modulo 2³². On 64-bit builds the addition is promoted to 64 bits and the check correctly rejects the input. Version 26.01 patches the issue.
AnalysisAI
Heap memory disclosure in 7-Zip 9.34 through 26.00 (32-bit builds only) allows a remote unauthenticated attacker to leak arbitrary heap contents into attacker-controlled extracted files by supplying a crafted SquashFS archive. The root cause is a 32-bit integer overflow in the SquashFS ReadBlock function: because size_t is 32 bits on 32-bit builds, the addition of offsetInBlock and blockSize wraps modulo 2³², bypassing the fragment bounds check and directing memcpy to read heap memory preceding the intended cache buffer. No public exploit has been identified at time of analysis, and no CISA KEV listing exists. Version 26.01 patches the issue.
Technical ContextAI
7-Zip's SquashFS parser contains a ReadBlock function responsible for reading compressed fragment data from an archive. The vulnerability (CWE-125: Out-of-bounds Read) arises because the bounds check on node.Offset is defeated by a 32-bit integer overflow: on 32-bit builds where size_t is a 32-bit type, the expression offsetInBlock + blockSize can wrap around modulo 2³², producing a result that passes the bounds check while the actual memcpy source pointer points to heap memory before the legitimate cache buffer. On 64-bit builds, the operands are promoted to 64-bit arithmetic, so the overflow cannot occur and the check correctly rejects malicious input. The affected CPE is cpe:2.3:a:mcmilk:7-zip:*:*:*:*:*:*:*:*, encompassing the mcmilk fork of 7-Zip, which is the actively maintained upstream. The vulnerability was discovered and reported by GitHub Security Lab (GHSL-2026-115/GHSL-2026-122).
RemediationAI
The primary fix is to upgrade to 7-Zip version 26.01, which patches the integer overflow in the SquashFS ReadBlock function. The vendor-released patch is confirmed at version 26.01 per GitHub Security Lab advisory GHSL-2026-115/GHSL-2026-122 (https://securitylab.github.com/advisories/GHSL-2026-115_GHSL-2026-122_7-zip/). Organizations unable to patch immediately should migrate to 64-bit builds of 7-Zip where possible, as the overflow cannot occur when size_t is 64 bits - this is an effective compensating control with no functional trade-off for most users. If SquashFS archive handling is not required in the deployment context, restricting processing of .squashfs or related archive types at the perimeter (e.g., mail gateway content filters, endpoint DLP rules) reduces exposure, though this does not eliminate the vulnerability if users can introduce archives through other channels. No other workarounds specific to this vulnerability were identified in the available data.
Heap-based buffer overflow in the NArchive::NHfs::CHandler::ExtractZlibFile method in 7zip before 16.00 and p7zip allows
The CInArchive::ReadFileItem method in Archive/Udf/UdfIn.cpp in 7zip 9.20 and 15.05 beta and p7zip allows remote attacke
Heap-based buffer overflow in 7-Zip's XZ archive parser enables arbitrary code execution when a victim opens a crafted a
A null pointer dereference bug affects the 16.02 and many old versions of p7zip. Rated high severity (CVSS 7.5), this vu
7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is d
Incorrect initialization logic of RAR decoder objects in 7-Zip 18.03 and before can lead to usage of uninitialized memor
Insufficient exception handling in the method NCompress::NRar3::CDecoder::Code of 7-Zip before 18.00 and p7zip can lead
p7zip 9.20.1 allows remote attackers to write to arbitrary files via a symlink attack in an archive. Rated medium severi
Heap buffer overflow in 7-Zip's RAR5 handler writes zeroes beyond allocated heap memory, causing memory corruption and d
Mark-of-the-Web protection is bypassed in 7-Zip for Windows 26.02 and earlier when extracting crafted RAR5 archives, all
Remote code execution in 7-Zip versions 26.00 and earlier is achievable via a crafted NTFS image that triggers a heap bu
7-Zip through 18.01 on Windows implements the "Large memory pages" option by calling the LsaAddAccountRights function to
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Desktop 15 SP7 | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP7 | Affected |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | Affected |
| SUSE Linux Enterprise Server 15 SP7 | Affected |
| SUSE Linux Enterprise Server 16.0 | Affected |
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP7 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| openSUSE Leap 16.0 | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | Affected |
| SUSE Linux Enterprise Server 15 SP4-LTSS | Affected |
| SUSE Linux Enterprise Server 15 SP5-LTSS | Affected |
| SUSE Linux Enterprise Server 15 SP6-LTSS | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today