Is CVE-2026-48104 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48104 being exploited in the wild.

How severe is CVE-2026-48104?

Medium severity, with a CVSS score of 4.2, published 5 June 2026.

Which products and versions are affected?

Igor Pavlov 7-Zip 9.18 through 26.00.

Is there a fix for CVE-2026-48104?

A patch was published on 2026-04-27: Version 26.01 released with fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48104 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-48104?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48104: 7-Zip uninitialized heap read in SquashFS handler

CVE-2026-48104 · Severity: medium · CVSS 4.2 · Published 2026-06-05

7-Zip is a widely used file archiving utility. A vulnerability in its SquashFS file handler allows a specially crafted archive to cause the application to crash or potentially leak small amounts of memory from the computer's temporary storage. This occurs automatically when a user attempts to open a malicious file, potentially leading to a denial of service or minor data exposure.

Quick answers

Is CVE-2026-48104 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48104 being exploited in the wild.
How severe is CVE-2026-48104?: Medium severity, with a CVSS score of 4.2, published 5 June 2026.
Which products and versions are affected?: Igor Pavlov 7-Zip 9.18 through 26.00.
Is there a fix for CVE-2026-48104?: A patch was published on 2026-04-27: Version 26.01 released with fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48104 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-48104?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An uninitialized heap read exists in the SquashFS handler due to a sparsely populated index array (_blockToNode). When processing a crafted SquashFS image where inodes span many blocks, the array contains uninitialized POD storage from the heap. During the Open() operation, the OpenDir function uses attacker-influenced indices to perform a binary search over these uninitialized values. This can result in a chained out-of-bounds (OOB) read primitive. While the vulnerability is triggered simply by opening a file, successful exploitation is highly dependent on heap layout and is not reliably triggerable. The issue is fixed in version 26.01.

Affected products

Igor Pavlov 7-Zip 9.18 through 26.00

Timeline

2026-04-21: disclosed: Reported to vendor via SourceForge private issues
2026-04-27: patched: Version 26.01 released with fixes
2026-06-05: advisory: CVE-2026-48104 published

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.