CVE-2026-104086

Name	CVE-2026-104086
Description	7-Zip before 26.03 contains an uninitialized memory disclosure vulnerability in the SquashFS v4 archive handler (SquashfsHandler.cpp) that allows attackers to leak heap memory by crafting a malicious archive where the superblock’s no_ids field is set so that the final metadata block’s expected size is miscomputed and bypasses the size validation check. By listing or extracting the crafted archive, attackers can cause the application to return uninitialized heap memory as the kpidUserId and kpidGroupId properties, exposing potentially sensitive process memory contents to the user.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
7zip (PTS)	bookworm	22.01+really26.01+dfsg-0+deb12u1	vulnerable
	bookworm (security)	22.01+really26.02+dfsg-0+deb12u1	vulnerable
	trixie	25.01+dfsg-1~deb13u2	vulnerable
	forky, sid	26.05+dfsg-1	fixed
p7zip (PTS)	bookworm	16.02+really26.01+dfsg-0+deb12u1	vulnerable
	bookworm (security)	16.02+really26.02+dfsg-0+deb12u1	vulnerable
	trixie	16.02+transitional.1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
7zip	source	(unstable)	26.03+dfsg-1	unimportant
p7zip	source	(unstable)	16.02+transitional.1	unimportant

Notes

Since p7zip/16.02+transitional.1 src:p7zip is only an empty source package
depending on 7zip. Mark this version as fixed version.
https://sourceforge.net/p/sevenzip/discussion/45797/thread/db6922e1d0/
Crosses no security boundary