Executive brief
7-Zip is a widely used file archiving utility for compressing and decompressing data. A vulnerability in how it handles certain archive formats could allow an attacker to read sensitive information from the computer's memory. This occurs when a user is tricked into opening a specially crafted archive file, potentially exposing private data to the attacker.
Technical details
A heap out-of-bounds read exists in 7-Zip's Unix 'ar' archive parser and SquashFS handler. In the 'ar' parser, the ParseLibSymbols function reads a 32-bit namesSize field via Get32 at a position that can equal the buffer size, leading to a 4-byte out-of-bounds read of uninitialized heap data. Additionally, in 32-bit builds, the SquashFS handler's ReadBlock function is vulnerable to an integer overflow when calculating fragment offsets. An attacker can provide a crafted node.Offset that causes a wrap-around, bypassing bounds checks and allowing memcpy to read up to 8MB of heap memory preceding the buffer into the extracted file. Both issues require a user to open a malicious archive. The vulnerabilities are patched in version 26.01.
Affected products
- 7-Zip 7-Zip 9.18 through 26.00
Timeline
- 2026-04-21: disclosed: Reported to vendor via SourceForge private issues
- 2026-04-27: patched: Version 26.01 released with fixes
- 2026-06-05: advisory: NVD publication date