The vulnerability is an off‑by‑one heap out‑of‑bounds read inside the WIM (Windows Imaging) archive handler used by 7‑Zip. The attacker can supply a crafted WIM file that contains a manipulated securityId field in the metadata. When the handler processes the file it reads one UInt32 past the end of the heap‑allocated vector. Because the value is only used as a length, the bug does not allow arbitrary code execution but can trigger a crash or a small amount of leaked data, which in hardened environments typically results in a denial of service.

Affected versions are 7‑Zip 9.34 through 26.00, which are delivered on Windows as a DLL and usable from the GUI (7zFM.exe) and the command‑line tools. The vulnerability exists for the file extensions .wim, .swm, .esd and .ppkg. The bug is registered in the default 7z.dll handler, so any installation of these versions that processes such file types is susceptible. The CVSS score for the weakness is 4.3 and the EPSS score is 2%, indicating a low but measurable likelihood of exploitation, and the issue is not listed in the CISA KEV catalogue.

The risk comes from any local user who opens a maliciously crafted WIM family file with the vulnerable version. The bug can be triggered with a zero‑click GUI list view or by invoking the command‑line listing option. The EPSS score of 2% indicates a low but measurable likelihood of exploitation, and with a CVSS score of 4.3 the impact is moderate. No write primitive is available, so the attack surface is limited to denial of service or minor data disclosure. Because the issue is not on KEV, vendors and users may not perceive an immediate urgency, but the potential for widespread interruption warrants corrective action.