The vulnerability is an off‑by‑one heap out‑of‑bounds read inside the WIM (Windows Imaging) archive handler used by 7‑Zip. The attacker can supply a crafted WIM file that contains a manipulated securityId field in the metadata. When the handler processes the file it reads one UInt32 past the end of the heap‑allocated vector. Because the value is only used as a length, the bug does not allow arbitrary code execution but can trigger a crash or a small amount of leaked data, which in hardened environments typically results in a denial of service.

Affected versions are 7‑Zip 9.34 through 26.00, which are delivered on Windows as a DLL and usable from the GUI (7zFM.exe) and the command‑line tools. The vulnerability exists for the file extensions .wim, .swm, .esd and .ppkg. The bug is registered in the default 7z.dll handler, so any installation of these versions that processes such file types is susceptible. The CVSS score for the weakness is 4.3 and the exploit probability is reported as unavailable, and the issue is not listed in the CISA KEV catalogue.

The risk comes from any local user who opens a maliciously crafted WIM family file with the vulnerable version. The bug can be triggered with a zero‑click GUI list view or by invoking the command‑line listing option. Although the CVSS score is moderate, the ease of exploitation means that anyone who can deliver such a file to a user’s machine can cause a service interruption. No write primitive is available, so the attack surface is limited to denial of service or minor data disclosure. Because the issue is not on KEV, vendors and users may not perceive an immediate urgency, but the potential for widespread interruption warrants corrective action.