# CVE-2026-48104: 7-Zip uninitialized heap read in SquashFS handler

Source: https://junglewise.ai/threats/cve-2026-48104-7-zip-uninitialized-heap-read-in-squashfs-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-05. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2026-48104 · Severity: medium · CVSS 4.2 · Published 2026-06-05

7-Zip is a widely used file archiving utility. A vulnerability in its SquashFS file handler allows a specially crafted archive to cause the application to crash or potentially leak small amounts of memory from the computer's temporary storage. This occurs automatically when a user attempts to open a malicious file, potentially leading to a denial of service or minor data exposure.

## Quick answers

**Is CVE-2026-48104 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48104 being exploited in the wild.

**How severe is CVE-2026-48104?** Medium severity, with a CVSS score of 4.2, published 5 June 2026.

**Which products and versions are affected?** Igor Pavlov 7-Zip 9.18 through 26.00.

**Is there a fix for CVE-2026-48104?** A patch was published on 2026-04-27: Version 26.01 released with fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48104 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-48104?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An uninitialized heap read exists in the SquashFS handler due to a sparsely populated index array (_blockToNode). When processing a crafted SquashFS image where inodes span many blocks, the array contains uninitialized POD storage from the heap. During the Open() operation, the OpenDir function uses attacker-influenced indices to perform a binary search over these uninitialized values. This can result in a chained out-of-bounds (OOB) read primitive. While the vulnerability is triggered simply by opening a file, successful exploitation is highly dependent on heap layout and is not reliably triggerable. The issue is fixed in version 26.01.

## Affected products

- Igor Pavlov 7-Zip 9.18 through 26.00

## Timeline

- 2026-04-21: disclosed: Reported to vendor via SourceForge private issues
- 2026-04-27: patched: Version 26.01 released with fixes
- 2026-06-05: advisory: CVE-2026-48104 published