CVE-2026-104086: 7-zip Use of Uninitialized Resource

Vulnerability summary

CVE-2026-104086 is a medium (CVSS 6.8) Use of Uninitialized Resource vulnerability in 7-zip. EPSS estimates a 0.19% chance of exploitation in the next 30 days, higher than 7.9% of scored vulnerabilities.

Timeline

1. 14-10-2026
   PublishedVulnerability first disclosed.
2. 19-10-2026
   Last modifiedVulnerability information updated.

Description

7-Zip before 26.03 contains an uninitialized memory disclosure vulnerability in the SquashFS v4 archive handler (SquashfsHandler.cpp) that allows attackers to leak heap memory by crafting a malicious archive where the superblock’s no_ids field is set so that the final metadata block’s expected size is miscomputed and bypasses the size validation check. By listing or extracting the crafted archive, attackers can cause the application to return uninitialized heap memory as the kpidUserId and kpidGroupId properties, exposing potentially sensitive process memory contents to the user.

• CWE-908Use of Uninitialized ResourceThe product uses or accesses a resource that has not been initialized.