Skip to main content

7-Zip CVE-2026-48104

| EUVDEUVD-2026-34853 MEDIUM
Use of Uninitialized Resource (CWE-908)
2026-06-05 GitHub_M
Denial Of Service Information Disclosure 7 Zip Suse Mcmilk
4.2
CVSS 3.1 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
4.2 MEDIUM
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L
SUSE
3.6 LOW
AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
Low

Lifecycle Timeline

2
Patch available
Jun 05, 2026 - 18:01 EUVD
Analysis Generated
Jun 05, 2026 - 17:20 vuln.today

DescriptionGitHub Advisory

7-Zip is a file archiver with a high compression ratio. Versions 9.18 through 26.00 contain an uninitialized heap read in the SquashFS archive handler caused by a sparsely populated index array. In the SquashFS handler, _blockToNode is allocated with capacity for every metadata block but populated only when an inode crosses a block boundary, so a crafted image with few inodes spanning many blocks leaves most slots holding raw heap contents (the underlying allocator does not zero-initialize POD storage). When OpenDir looks up an attacker-influenced blockIndex (derived from the RootInode superblock field), it reads two of these uninitialized slots and passes them as the left/right bounds of a binary search over _nodesPos, which dereferences the midpoint without bounds checking; if the resulting value happens to match the search key, the returned index is used to read a full node struct from _nodes whose fields feed further directory parsing, forming a chained OOB read primitive that is heap-layout-dependent and not reliably triggerable. The SquashFS handler is enabled by default in stock 7z.dll and the issue triggers during Open() with no interaction beyond opening the file; impact is denial of service from wild-pointer dereference and potential heap information disclosure, with no write primitive. Version 26.01 fixes the issue.

AnalysisAI

Uninitialized heap read in 7-Zip's SquashFS archive handler (versions 9.18 through 26.00) can crash the application and leak raw heap memory contents when a user opens a specially crafted archive. The flaw originates in the _blockToNode array, which is allocated but never zero-initialized; an attacker-controlled blockIndex derived from the RootInode superblock field drives a binary search over uninitialized slots, producing a chained out-of-bounds read with no write primitive. No public exploit has been identified at time of analysis, and the description explicitly characterizes exploitation as heap-layout-dependent and not reliably triggerable, which is consistent with the CVSS AC:H rating and limits practical risk despite the network-deliverable attack surface.

Technical ContextAI

The affected component is 7-Zip's SquashFS archive handler, identified via CPE cpe:2.3:a:mcmilk:7-zip:*:*:*:*:*:*:*:* as the mcmilk community-maintained fork. The root cause is CWE-908 (Use of Uninitialized Resource): _blockToNode is allocated with capacity for every metadata block in the SquashFS image but is populated only when an inode crosses a block boundary. Because the underlying C++ allocator does not zero-initialize plain-old-data (POD) storage, a crafted image with few inodes spanning many blocks leaves most array slots holding raw heap residue from prior allocations. The OpenDir function reads two of these uninitialized slots as the left and right bounds for a binary search over _nodesPos, then dereferences the computed midpoint without bounds validation. If the dereferenced value matches the search key, the returned index is used to read a full node struct from _nodes, whose fields feed further directory parsing - forming a chained OOB read primitive. The SquashFS handler is enabled by default in stock 7z.dll, and the vulnerability triggers during Open() without any interaction beyond the act of opening the archive.

RemediationAI

Upgrade 7-Zip to version 26.01, which resolves this vulnerability per the CVE description and the GitHub Security Lab advisory (GHSL-2026-115, GHSL-2026-122) at https://securitylab.github.com/advisories/GHSL-2026-115_GHSL-2026-122_7-zip/. If an immediate upgrade is not feasible, restrict the ability to open untrusted SquashFS archives via 7-Zip by blocking SquashFS file extensions (.sqfs, .sfs) at email gateways, web proxies, or endpoint DLP controls - this eliminates the delivery vector at the cost of blocking legitimate SquashFS file handling. Because the SquashFS handler is compiled into 7z.dll and enabled by default, there is no documented runtime configuration switch to disable it selectively; removal or replacement of the DLL would mitigate the issue but would disable all 7z.dll-dependent functionality. No other vendor-documented workarounds are available in the referenced advisory.

More in 7 Zip

View all
CVE-2016-2334 HIGH POC
7.8 Dec 13

Heap-based buffer overflow in the NArchive::NHfs::CHandler::ExtractZlibFile method in 7zip before 16.00 and p7zip allows
CVE-2016-2335 HIGH POC
8.8 Jun 07

The CInArchive::ReadFileItem method in Archive/Udf/UdfIn.cpp in 7zip 9.20 and 15.05 beta and p7zip allows remote attacke
CVE-2026-14266 HIGH POC
7.8 Jul 15

Heap-based buffer overflow in 7-Zip's XZ archive parser enables arbitrary code execution when a victim opens a crafted a
CVE-2016-9296 HIGH POC
7.5 Nov 12

A null pointer dereference bug affects the 16.02 and many old versions of p7zip. Rated high severity (CVSS 7.5), this vu
CVE-2022-29072 HIGH POC
7.8 Apr 15

7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is d
CVE-2018-10115 HIGH POC
7.8 May 02

Incorrect initialization logic of RAR decoder objects in 7-Zip 18.03 and before can lead to usage of uninitialized memor
CVE-2018-5996 HIGH POC
7.8 Jan 31

Insufficient exception handling in the method NCompress::NRar3::CDecoder::Code of 7-Zip before 18.00 and p7zip can lead

CVE-2015-1038 MEDIUM POC
5.8 Jan 21

p7zip 9.20.1 allows remote attackers to write to arbitrary files via a symlink attack in an archive. Rated medium severi
CVE-2025-53816 MEDIUM POC
5.5 Jul 17

Heap buffer overflow in 7-Zip's RAR5 handler writes zeroes beyond allocated heap memory, causing memory corruption and d
CVE-2026-58052 MEDIUM POC
4.8 Jun 28

Mark-of-the-Web protection is bypassed in 7-Zip for Windows 26.02 and earlier when extracting crafted RAR5 archives, all
CVE-2026-48095 HIGH
8.8 Jun 05

Remote code execution in 7-Zip versions 26.00 and earlier is achievable via a crafted NTFS image that triggers a heap bu
CVE-2018-10172 HIGH
8.8 Apr 16

7-Zip through 18.01 on Windows implements the "Large memory pages" option by calling the LsaAddAccountRights function to

Same weakness CWE-908 – Use of Uninitialized Resource

View all
CVE-2011-1255 CRITICAL POC
9.3
CVE-2024-50302 MEDIUM
5.5
CVE-2024-12085 HIGH POC
7.5
CVE-2021-1104 CRITICAL POC
9.8
CVE-2021-29937 CRITICAL POC
9.8
CVE-2021-29936 CRITICAL POC
9.8
CVE-2021-26305 CRITICAL POC
9.8
CVE-2019-9641 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Low
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected

Share

CVE-2026-48104 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy