7-Zip EUVD-2026-34857

The vulnerability resides in 7-Zip's Ar (Unix archive) format handler, specifically in the ParseLibSymbols function responsible for parsing BSD-style __.SYMDEF symbol tables embedded in .ar archives. The function reads a 32-bit namesSize field using the Get32 helper at an offset that can legally equal the heap allocation's terminal boundary, causing a 4-byte overread into adjacent, uninitialized heap memory under the default allocator. The CWE-190 classification (Integer Overflow or Wraparound) indicates that an integer calculation governing the read position fails to enforce a strict less-than bound check before performing the Get32 read, conflating an at-boundary position with a valid within-bounds position. The affected CPE is cpe:2.3:a:mcmilk:7-zip:*:*:*:*:*:*:*:*, which corresponds to the mcmilk community-maintained fork of 7-Zip; analysts should verify whether the upstream Igor Pavlov distribution shares the identical parser code. The root cause is a boundary condition off-by-one in a 32-bit field extraction, not a memory corruption write - limiting impact to confidentiality.