The vulnerability is a heap out‑of‑bounds read in the Unix ar archive handler of 7‑Zip. When parsing a BSD‑style __.SYMDEF symbol table the parser reads four bytes past the end of the allocated buffer, which can expose uninitialized heap contents. This flaw can lead to leakage of sensitive data that resides on the heap at the time the file is processed.

Vendor 7‑Zip (Mcmilk) versions 9.18 through 26.00 are affected. The issue is fixed in release 26.01 and later.

The CVSS score of 6.5 indicates moderate severity. EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is local; an adversary would need to supply a specially crafted .ar file and invoke 7‑Zip to trigger the read. While the read does not provide direct code execution, the potential exposure of data makes the flaw significant for systems dealing with untrusted archives.