Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| 7-Zip | 7-Zip | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Wed, 14 Oct 2026 14:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | 7-Zip before 26.03 contains an uninitialized memory disclosure vulnerability in the SquashFS v4 archive handler (SquashfsHandler.cpp) that allows attackers to leak heap memory by crafting a malicious archive where the superblock’s no_ids field is set so that the final metadata block’s expected size is miscomputed and bypasses the size validation check. By listing or extracting the crafted archive, attackers can cause the application to return uninitialized heap memory as the kpidUserId and kpidGroupId properties, exposing potentially sensitive process memory contents to the user. | |
| Title | 7-Zip < 26.03 SquashFS Uninitialized Memory Disclosure via UID/GID Table | |
| Weaknesses | CWE-908 | |
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-10-14T14:06:14.543Z
Reserved: 2026-10-01T18:02:50.085Z
Link: CVE-2026-104086
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-14T14:17:30.670
Modified: 2026-10-14T14:17:30.670
Link: CVE-2026-104086
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-908
Use of Uninitialized Resource