7‑Zip older than 26.03 has an uninitialized memory disclosure in the SquashFS v4 archive handler. When a crafted archive sets the superblock’s no_ids field to miscompute the final metadata block size, the size validation is bypassed, causing the application to expose uninitialized heap memory as the kpidUserId and kpidGroupId properties during extraction or listing. If an attacker can supply such an archive, they can read arbitrary contents of the process’s heap, potentially revealing sensitive data such as passwords, keys, or other confidential information.

All installations of 7‑Zip 7‑Zip with a version earlier than 26.03 are impacted. The vulnerability is independent of the operating system; any platform running the affected 7‑Zip binary is susceptible if it processes a malicious SquashFS archive.

The CVSS score of 6.8 indicates a medium severity vulnerability. Because the EPSS score is 0.188%, the likelihood of exploitation is low; the vulnerability is not listed in the CISA KEV catalog, so no known widespread exploitation yet. The attack requires an attacker to supply a crafted archive to the target system. The likely attack vector is local or remote delivery of a malicious archive that a user or service extracts or lists, leading to leaking of heap memory contents.