CVE-2026-48104

Name of the Vulnerable Software and Affected Versions 7-Zip versions 9.18 through 26.00

Description An uninitialized heap read exists in the SquashFS archive handler due to a sparsely populated index array. The blockToNode array is allocated for every metadata block but only populated when an inode crosses a block boundary. A crafted image with few inodes spanning many blocks leaves most slots containing raw heap contents. When the OpenDir function looks up an attacker-influenced blockIndex (derived from the RootInode superblock field), it reads two uninitialized slots and uses them as bounds for a binary search over nodesPos. This process dereferences the midpoint without bounds checking. If the value matches the search key, the returned index reads a full node struct from nodes for directory parsing, creating a chained out-of-bounds read primitive. This issue triggers during the Open() function when opening a file and can lead to denial of service via wild-pointer dereference or potential heap information disclosure.

Recommendations Update to version 26.01.