A 32‑bit integer overflow in the SquashFS ReadBlock function of 7‑Zip allows an attacker‑controlled node.Offset value to bypass bound checks, causing memcpy to read heap memory preceding the cache buffer into the extracted file. The vulnerability can expose sensitive data by leaking heap contents, compromising confidentiality. The CVSS score of 4.3 indicates a low severity level for this information‑disclosure flaw.

The flaw affects 7‑Zip versions 9.34 through 26.00 on 32‑bit builds where size_t is 32 bits, including the standard 32‑bit executable. 64‑bit builds are immune because the addition is promoted to 64 bits and the check correctly rejects the input. 26.01 and later versions contain a patch that removes the overflow.

The vulnerability is exploitable only locally: an attacker must supply a crafted SquashFS archive to a system running a 32‑bit 7‑Zip build. Because EPSS is not available and the issue is not listed in CISA KEV, the likelihood of widespread exploitation is low, but privileged users who process untrusted archives could gain access to arbitrary memory contents. The impact remains limited to information disclosure rather than code execution or denial of service.