An uninitialized heap read exists in 7‑Zip’s SquashFS archive handler for versions 9.18 through 26.00. The handler allocates an index array for every metadata block but populates only the slots when an inode crosses a block boundary; many entries thus contain raw allocator contents. When a crafted SquashFS image is opened, _blockToNode is accessed with a block index derived from the root inode superblock, causing the binary search to use uninitialized values as bounds and to dereference a mid‑point without bounds checking. The ultimate effect is a chained out‑of‑bounds read that can expose uninitialised heap memory but provides no write primitive, leading to a wild‑pointer dereference and a denial of service during file opening.

The vulnerability affects mcmilk's 7‑Zip product, specifically releases from 9.18 up to and including 26.00. The documented SquashFS support is enabled by default in the standard 7z.dll distribution and is activated automatically when a SquashFS archive is opened. A patched release, version 26.01 or later, removes the flaw and reinitialises the index array correctly.

The CVSS score of 4.2 indicates moderate severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Exploitation requires only that an attacker deliver a specially crafted SquashFS image and that the victim opens it, typically via phishing or email attachments. The read is heap‑layout dependent and not reliably triggerable, so while the potential for information disclosure exists, the likelihood of successful exploitation is limited and the impact is largely a denial of service from a wild‑pointer dereference.