CVE-2026-104086

Awaiting Analysis Awaiting Analysis - Queue

Zip Uninitialized Memory Disclosure in SquashFS Handler

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

7-Zip before 26.03 contains an uninitialized memory disclosure vulnerability in the SquashFS v4 archive handler (SquashfsHandler.cpp) that allows attackers to leak heap memory by crafting a malicious archive where the superblock’s no_ids field is set so that the final metadata block’s expected size is miscomputed and bypasses the size validation check. By listing or extracting the crafted archive, attackers can cause the application to return uninitialized heap memory as the kpidUserId and kpidGroupId properties, exposing potentially sensitive process memory contents to the user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-104086

EUVD

EUVD-2026-101032

Affected Vendors & Products

Vendor	Product	Version / Range
7-Zip	7-Zip	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-908	The product uses or accesses a resource that has not been initialized.

Attack-Flow Graph

Executive Summary

This vulnerability is an uninitialized memory disclosure issue in 7-Zip versions before 26.03. It occurs in the SquashFS v4 archive handler where attackers craft a malicious archive with a manipulated superblock no_ids field. This miscomputes the metadata block size, bypassing validation checks. When the archive is listed or extracted, the application returns uninitialized heap memory as kpidUserId and kpidGroupId, exposing sensitive process memory.

Detection Guidance

To detect this vulnerability, check the installed version of 7-Zip on your system. If it is below 26.03, the system is vulnerable. Use the command '7z' or '7zr' to check the version. Compare the output with the latest version 26.04 from the official 7-Zip website.

Impact Analysis

An attacker could exploit this to leak sensitive memory contents from your system when you interact with a crafted SquashFS archive. This may expose confidential data, such as passwords or encryption keys, if the leaked memory contains such information. The impact depends on the data processed by the vulnerable 7-Zip instance.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of personal or sensitive data, violating GDPR's data protection principles or HIPAA's confidentiality requirements. Organizations using vulnerable 7-Zip versions may face compliance breaches if sensitive data is exposed through memory leaks.

Mitigation Strategies

Immediately update 7-Zip to version 26.04 or later from the official website. Avoid opening or extracting untrusted SquashFS archives until the update is applied. Monitor for suspicious archive files in your environment.

Hi! I’m here to help you understand CVE-2026-104086. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70