7‑Zip contains an uninitialized memory disclosure in its UEFI capsule (.scap) parser. The OpenCapsule function allocates a heap buffer whose size is declared by the attacker but does not zero‑initialize it. Data from the file is loaded with ReadStream_FALSE, and the function disregards the return value; if the file is truncated, unread bytes remain uninitialized. Those bytes later become part of the extracted file content returned via GetStream, letting an attacker read memory that was never overwritten.

Versions 9.21 through 26.00 of 7‑Zip, released by mcmilk, are affected. The issue is fixed in version 26.0.1 and later.

The CVSS score of 6.5 indicates moderate severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker can exploit this by supplying a crafted .scap file to an affected 7‑Zip installation, causing it to expose uninitialized memory. Since 7‑Zip is a local application, the attack vector is primarily local or requires a user to open a malicious file. No network‑based exploitation is reported in the available data.