7‑Zip versions 9.11 through 26.00 contain a heap out‑of‑bounds read that can reveal one or more bits of memory during the parsing of a UDF disc image. The flaw does not allow write or code execution; its impact is limited to a small information leak and the possibility of a crash when hardened allocators are used. The attack results in a 1‑bit oracle per over‑read byte and can be triggered when a malicious .iso or .udf file is opened or listed.

The vulnerability affects the 7‑Zip file archiver from the mcmilk vendor. It is present in all releases between 9.11 and 26.00 inclusive. Version 26.01 applies a fix that removes the out‑of‑bounds read by correcting the loop bounds and the post‑read check. Users running any intermediate versions must be aware that UDF file handling is the triggered code path.

The CVSS score of 3.1 indicates a low overall risk, and the EPSS score is not provided, which does not point to a high exploitation probability. The flaw is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. However, the vulnerability can be invoked by loading a crafted UDF image, which is auto‑detected by 7‑Zip, meaning that local users or any privileged process that unpacks or lists such files could be affected. The lack of a write primitive keeps the attack surface relatively narrow, but the potential for denial of service could impact availability in environments that heavily rely on automated archive extraction.