7-Zip EUVD-2026-101032

Exploitation requires the victim to list or extract a crafted SquashFS v4 archive using a vulnerable 7-Zip build (before 26.03); specifically the archive's superblock no_ids field must be set so the final metadata block's expected size is miscomputed and bypasses the size validation check in SquashfsHandler.cpp. Limiting factors: the attack vector is local (the user must process an attacker-supplied file), mandatory user interaction is required (UI:P - opening/listing/extracting the archive), and the impact is confined to disclosure of uninitialized heap memory surfaced through the kpidUserId and kpidGroupId properties - there is no code execution, integrity, or availability impact. No authentication is required (PR:N), and default configurations are affected because SquashFS handling is built into standard archive processing.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 4.0 base score of 6.8 (Medium) reflects local attack vector (AV:L), low complexity (AC:L), no privileges required (PR:N), but mandatory passive user interaction (UI:P) and a confidentiality-only impact (VC:H, VI:N, VA:N) consistent with CWE-908 uninitialized memory disclosure. No EPSS score, SSVC decision, or KEV status was provided in the input, and there is no indication of a public POC - so exploitation status is 'no public exploit identified at time of analysis.' The flaw was reported by VulnCheck (a credible vulnerability-intelligence vendor) and a vendor patch (7-Zip 26.03) is available, which raises defensive priority for an application this widely installed. The key tempering factors are that the attack is not remote/automatable - a user must actively list or extract an attacker-supplied archive - and the impact is limited to leaking heap memory contents (potentially sensitive process data) rather than code execution or integrity loss. Net: patch-worthy given 7-Zip's huge install base and the trivial crafting of a malicious archive, but the local vector plus required user interaction keep real-world risk below that of a remotely exploitable RCE.

An attacker crafts a malicious SquashFS v4 archive whose superblock no_ids field forces the final metadata block's expected size to be miscomputed, bypassing the size validation check in SquashfsHandler.cpp. The attacker delivers this archive via email, a download link, or a shared file, and when the victim merely lists or extracts it in a vulnerable 7-Zip build, the application returns uninitialized heap memory in the kpidUserId and kpidGroupId properties, exposing potentially sensitive process memory to the attacker. No public exploit code was identified in the provided data, though the described trigger is straightforward to reproduce.