CVE-2026-104086— 7-Zip < 26.03 SquashFS Uninitialized Memory Disclosure via UID/GID Table
Quick assessment
Affected
7-Zip 7-Zip
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
7-Zip 在 26.03 版本之前存在一个未初始化内存泄露漏洞，该漏洞位于 SquashFS v4 归档处理器（SquashfsHandler.cpp）中。攻击者可通过构造恶意归档文件，利用超块（superblock）中的 no_ids 字段设置，导致最终元数据块（metadata block）的预期大小计算错误，从而绕过大小验证检查。通过列出或提取该恶意归档文件，攻击者可导致应用程序将未初始化的堆内存作为 kpidUserId 和 kpidGroupId 属性返回，从而向用户暴露潜在的敏感进程内存内容。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-104086
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
7-Zip < 26.03 SquashFS Uninitialized Memory Disclosure via UID/GID Table
Source: CVE Program / CVE List V5
Vulnerability Description
7-Zip before 26.03 contains an uninitialized memory disclosure vulnerability in the SquashFS v4 archive handler (SquashfsHandler.cpp) that allows attackers to leak heap memory by crafting a malicious archive where the superblock’s no_ids field is set so that the final metadata block’s expected size is miscomputed and bypasses the size validation check. By listing or extracting the crafted archive, attackers can cause the application to return uninitialized heap memory as the kpidUserId and kpidGroupId properties, exposing potentially sensitive process memory contents to the user.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对未经初始化资源的使用
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-104086
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-104086
请登录查看更多情报信息。
Other References for CVE-2026-104086 (2)
-
7-Zip product
IV. Related Vulnerabilities
Same product: 7-Zip
-
CVE-2026-14266
7-Zip XZ Decompression Heap-based Buffer Overflow Remote Cod -
CVE-2026-58052
7-Zip - Mark-of-the-Web Bypass via RAR5 Alternate Data Strea -
CVE-2026-48112
GHSL-2026-122 7-Zip Ar SYMDEF OOB Read -
CVE-2026-48111
GHSL-2026-121 7-Zip UEFI DEPEX OOB Read -
CVE-2026-48104
GHSL-2026-120: 7-Zip SquashFS BlockToNode uninitialized heap
Same vendor: 7-Zip
-
CVE-2026-14266
7-Zip XZ Decompression Heap-based Buffer Overflow Remote Cod -
CVE-2026-58052
7-Zip - Mark-of-the-Web Bypass via RAR5 Alternate Data Strea -
CVE-2025-11002
7-Zip ZIP File Parsing Directory Traversal Remote Code Execu -
CVE-2025-11001
7-Zip ZIP File Parsing Directory Traversal Remote Code Execu -
CVE-2025-55188
7-Zip 安全漏洞
Same weakness: CWE-908
-
CVE-2026-109438
3proxy 0.9.7 - 1.0.1 Uninitialized Stack Memory Disclosure v -
CVE-2026-97629
NGINX ngx_http_ssl_module vulnerability -
CVE-2026-102187
Windows Kernel Information Disclosure Vulnerability -
CVE-2026-97011
Microsoft Office Excel Remote Code Execution Vulnerability -
CVE-2026-96850
Windows Modern Device Management (MDM) Information Disclosur
V. Comments for CVE-2026-104086
No comments yet