CVE-2026-104086: 
7-Zip vulnerability analysis and mitigation

CVE-2026-104086 is an uninitialized memory disclosure vulnerability in 7-Zip's SquashFS v4 archive handler (SquashfsHandler.cpp) affecting all versions before 26.03. By crafting a malicious SquashFS archive with a manipulated superblock no_ids field, attackers can cause the final metadata block's expected size to be miscomputed, bypassing size validation and leaking uninitialized heap memory via the kpidUserId and kpidGroupId properties when the archive is listed or extracted. It was disclosed on October 14, 2026, and assigned by VulnCheck. It carries a CVSS v3.1 base score of 5.5 (Medium) and a CVSS v4.0 base score of 6.8 (Medium) (VulnCheck Advisory, EUVD).

The root cause is classified as CWE-908 (Use of Uninitialized Resource). The vulnerability resides in the SquashFS v4 handler in SquashfsHandler.cpp, where the no_ids field in the archive superblock is used to compute the expected size of the final metadata block containing UID/GID tables. An attacker can craft this field so that the computed size is incorrect, causing the size validation check to pass while the application subsequently reads beyond valid data into uninitialized heap memory. The uninitialized memory is then surfaced to the user as the kpidUserId and kpidGroupId archive properties when listing or extracting the archive. Exploitation requires local access and user interaction (opening the malicious archive), but no privileges are required (VulnCheck Advisory, 7-Zip Forum).

Successful exploitation results in a high confidentiality impact with no integrity or availability impact. An attacker who tricks a user into opening a crafted SquashFS archive can obtain potentially sensitive contents of the 7-Zip process's heap memory, which may include cryptographic material, credentials, or other sensitive data resident in memory at the time of processing. The scope is limited to the local system and the 7-Zip process's memory space, with no direct path to code execution or data modification (VulnCheck Advisory).

As of the disclosure date (October 14, 2026), no public proof-of-concept exploit code, exploit kit integration, or in-the-wild exploitation has been reported. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — a victim must open a specially crafted archive — which limits the attack surface compared to network-exploitable vulnerabilities (VulnCheck Advisory).

1. Craft malicious archive: Create a SquashFS v4 archive with a manipulated superblock no_ids field set to a value that causes the expected size of the final UID/GID metadata block to be miscomputed, bypassing the size validation check in SquashfsHandler.cpp.
2. Deliver the archive: Distribute the crafted .sqfs or similarly named archive to the target via email attachment, file share, download link, or other social engineering vector.
3. Induce user interaction: Convince the target user to open the archive in 7-Zip (e.g., by listing or extracting its contents), which triggers the vulnerable code path in the SquashFS handler.
4. Capture leaked memory: Observe the kpidUserId and kpidGroupId properties returned by 7-Zip, which contain uninitialized heap memory from the 7-Zip process. Depending on heap layout, this memory may contain sensitive data such as passwords, keys, or other recently processed content (VulnCheck Advisory).

• File System: Presence of unexpected or unsolicited .sqfs (SquashFS) archive files delivered via email, downloads, or shared drives.
• Logs: 7-Zip process activity logs showing repeated listing or extraction of SquashFS archives from untrusted or external sources.
• Process: 7-Zip (7z.exe, 7zFM.exe) spawned with SquashFS archive arguments from unusual parent processes (e.g., browser, email client, script interpreter), potentially indicating social engineering delivery.

Users should upgrade 7-Zip to version 26.03 or later, which contains the fix for this vulnerability. No configuration-based workaround is available; the only effective mitigation is patching. As an interim measure, organizations can restrict the opening of SquashFS archives from untrusted sources and educate users not to open archive files from unknown senders. The updated version is available from the official 7-Zip website (7-Zip Official, VulnCheck Advisory).

The vulnerability was reported and disclosed by VulnCheck, with a corresponding discussion thread posted on the official 7-Zip SourceForge forum. No significant broader media coverage or notable researcher commentary beyond the initial VulnCheck advisory has been identified at this time (7-Zip Forum, VulnCheck Advisory).