CVE-2026-48104: 
7-Zip vulnerability analysis and mitigation

CVE-2026-48104 is an uninitialized heap read vulnerability in the SquashFS archive handler of 7-Zip, classified under CWE-908 (Use of Uninitialized Resource) and CWE-125 (Out-of-bounds Read). It affects 7-Zip versions 9.18 through 26.00 and was reported to the project on 2026-04-21, with a fix released in version 26.01 on 2026-04-27. The vulnerability was publicly disclosed on 2026-06-05 as part of a broader advisory covering multiple memory access violations in 7-Zip (GHSL-2026-115 through GHSL-2026-122). It carries a CVSS v3.1 base score of 4.2 (Medium) (GitHub Security Lab).

The root cause lies in the _blockToNode index array within the SquashFS handler (SquashfsHandler.cpp). The array is allocated via ClearAndReserve(GetNumBlocks() + 1) using new UInt32[capacity], which does not zero-initialize POD storage, but is only populated at inode block boundaries. A crafted SquashFS image with few inodes spanning many metadata blocks leaves most array slots holding raw heap contents. When OpenDir resolves a blockIndex derived from the attacker-controlled RootInode superblock field, it reads two uninitialized slots as the left/right bounds for a FindInSorted binary search over _nodesPos, which dereferences the midpoint without bounds checking. If the OOB-read value coincidentally matches the search key, the returned index is used to read a full CNode struct from _nodes, creating a chained OOB read primitive that is heap-layout-dependent and not reliably triggerable (GitHub Security Lab).

Successful exploitation can result in denial of service via wild-pointer dereference and potential heap information disclosure. Because the SquashFS handler is enabled by default in stock 7z.dll and the vulnerability triggers during Open() with no interaction beyond opening the file, an attacker can deliver a crafted .squashfs or .sfs file to a victim and cause a crash or leak heap contents. There is no write primitive, so code execution is not directly achievable through this specific issue; integrity is not impacted (GitHub Security Lab).

1. Craft malicious archive: Use the published PoC Python script to generate a SquashFS v4 image with a single file inode spanning multiple metadata blocks (e.g., 50 data block size entries), ensuring _blockToNode is sparsely populated and most slots remain uninitialized.
2. Set attacker-controlled superblock field: Configure the RootInode field in the SquashFS superblock to reference a blockIndex value ≥ 2 (within GetNumBlocks()) so that OpenDir reads uninitialized heap slots as binary search bounds.
3. Deliver the archive: Distribute the crafted .sfs or .squashfs file to the target via email, download link, or other social engineering vector, relying on user interaction to open it in 7-Zip.
4. Trigger the vulnerability: When the victim opens the file in 7-Zip (GUI double-click or 7zz l), Open() calls OpenDir, which reads uninitialized _blockToNode slots and passes them as bounds to FindInSorted, dereferencing _nodesPos[mid] out-of-bounds.
5. Observe outcome: Depending on heap layout, the result is either a crash (DoS via wild-pointer dereference) or, if the OOB-read value matches the search key, a chained read of an arbitrary _nodes entry — leaking heap contents (GitHub Security Lab).

• File System: Unexpected .squashfs or .sfs files delivered via email attachments, downloads, or shared drives, particularly with unusually small inode counts relative to declared block counts.
• Process: 7-Zip process (7zz, 7z.exe, or 7zFM.exe) crashing unexpectedly or terminating with access violation errors when opening SquashFS archives.
• Logs: Application crash reports or Windows Error Reporting entries referencing 7z.dll or 7zz with faulting module offsets in SquashfsHandler.cpp-related code paths; MemorySanitizer or ASan output (in instrumented builds) showing use-of-uninitialized-value in FindInSorted or OpenDir.
• Network: Downloads of .sfs or .squashfs files from untrusted or anomalous external sources to endpoints running vulnerable 7-Zip versions (GitHub Security Lab).

Upgrade 7-Zip to version 26.01 or later, which fixes the uninitialized _blockToNode read by ensuring proper initialization of the array. Until patching is possible, avoid opening untrusted SquashFS (.squashfs, .sfs) archives in 7-Zip, or restrict the SquashFS handler if operationally feasible. Detection plugins are available in Nessus (IDs 321160, 321161) and Qualys (ID 288889) to identify vulnerable installations (GitHub Security Lab).

The vulnerability was disclosed by Jaroslav Lobačevski of GitHub Security Lab as part of a coordinated disclosure covering eight distinct memory safety issues in 7-Zip. The advisory was discussed on the oss-security mailing list shortly after publication. Linux distribution security teams, including Fedora, issued update advisories for their packaged 7-Zip builds in response to the broader advisory (oss-security, Linux Security).