Log in Start free

Vulnerability · Published Oct 14, 2026 · Assigned by VulnCheck

CVE-2026-1040867-Zip < 26.03 SquashFS Uninitialized Memory Disclosure via UID/GID Table

Medium 5.5

In plain English

A medium-severity security flaw in 7-Zip from 7-Zip. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.2%top 91.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

7-Zip before 26.03 contains an uninitialized memory disclosure vulnerability in the SquashFS v4 archive handler (SquashfsHandler.cpp) that allows attackers to leak heap memory by crafting a malicious archive where the superblock’s no_ids field is set so that the final metadata block’s expected size is miscomputed and bypasses the size validation check. By listing or extracting the crafted archive, attackers can cause the application to return uninitialized heap memory as the kpidUserId and kpidGroupId properties, exposing potentially sensitive process memory contents to the user.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:127zipno fix listedDEBIAN-CVE-2026-104086
Debian:137zipno fix listedDEBIAN-CVE-2026-104086
Debian:147zip26.03+dfsg-1DEBIAN-CVE-2026-104086
Debian:12p7zipno fix listedDEBIAN-CVE-2026-104086
Debian:13p7zip16.02+transitional.1DEBIAN-CVE-2026-104086
Ubuntu:26.04:LTS7zipno fix listedUBUNTU-CVE-2026-104086
Ubuntu:26.107zipno fix listedUBUNTU-CVE-2026-104086
Ubuntu:22.04:LTSp7zipno fix listedUBUNTU-CVE-2026-104086
Ubuntu:24.04:LTSp7zipno fix listedUBUNTU-CVE-2026-104086

Affected products (as reported)

VendorProductVersions
7-Zip 7-Zip 0 – before 26.03

Weakness: CWE-908 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References