CVE-2026-104086 json
7-Zip < 26.03 SquashFS Uninitialized Memory Disclosure via UID/GID Table
published 2026-10-14 26 d ago modified 2026-10-19 20 d ago also EUVD-2026-101032
- cvss
- 5.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 8%
- public exploits
- 0
- none known
Summary
7-Zip before 26.03 contains an uninitialized memory disclosure vulnerability in the SquashFS v4 archive handler (SquashfsHandler.cpp) that allows attackers to leak heap memory by crafting a malicious archive where the superblock’s no_ids field is set so that the final metadata block’s expected size is miscomputed and bypasses the size validation check. By listing or extracting the crafted archive, attackers can cause the application to return uninitialized heap memory as the kpidUserId and kpidGroupId properties, exposing potentially sensitive process memory contents to the user.
Patch / fix
- 7-Zip 7-Zip 26.03
- 7zip Debian 14 26.03+dfsg-1
- p7zip Debian 13 16.02+transitional.1
debian advisories DEBIAN-CVE-2026-104086
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 20 d ago
Exploit prediction
0.19% chance of exploitation in the next 30 days, higher than 8% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.8 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
| CNA | 4.0 | 6.8 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- 7-Zip 7-Zip
Classification
- Weakness
-
- CWE-908 Use of Uninitialized Resource
References
-
sourceforge.net
/p/sevenzip/discussion/45797/thread/db6922e1d0/
release-notes, patch
-
7-zip.org
/
product
-
vulncheck.com
/advisories/7-zip-squashfs-uninitialized-memory-disclosure-via-uid-gid-table
third-party-advisory
Sources
- CVE List CVE-2026-104086
- NVD CVE-2026-104086
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.