PatchSiren cyber security CVE debrief
CVE-2026-48104 mcmilk CVE debrief
CVE-2026-48104 is a MEDIUM severity vulnerability in 7-Zip, a file archiver with a high compression ratio. The issue, caused by an uninitialized heap read in the SquashFS archive handler, affects versions 9.18 through 26.00. This vulnerability is triggered when opening a crafted SquashFS image, leading to a potential denial of service due to a wild-pointer dereference and possible heap information disclosure. The vulnerability has a CVSS score of 4.2 and was published on 2026-06-05T17:16:48.547Z.
- Vendor
- mcmilk
- Product
- 7-Zip
- CVSS
- MEDIUM 4.2
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-05
- Original CVE updated
- 2026-06-08
- Advisory published
- 2026-06-05
- Advisory updated
- 2026-06-08
Who should care
Users of 7-Zip, especially those who handle archive files from untrusted sources, should be aware of this vulnerability. Developers and administrators should prioritize updating to version 26.01 or later to mitigate this issue.
Technical summary
The SquashFS handler in 7-Zip is vulnerable to an uninitialized heap read. When processing a sparsely populated index array in a SquashFS archive, the handler may read uninitialized heap memory. This can occur when the _blockToNode array is allocated but not fully populated, leaving some slots with raw heap contents. An attacker-crafted image can exploit this by influencing the blockIndex, leading to a chained out-of-bounds read primitive.
Defensive priority
High
Recommended defensive actions
- Update 7-Zip to version 26.01 or later.
- Be cautious when opening archive files from untrusted sources.
Evidence notes
The CVE record and NVD detail provide comprehensive information about this vulnerability. Additional details can be found in the security advisory at resourceLinkAnnotations with id 'ref-4'.
Sources and references
Verified primary and authoritative sources
-
CVE-2026-48104 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2026-48104
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2026-48104 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2026-48104
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Supplemental references
-
Mitigation or vendor reference
Unverified legacy reference
URL: https://securitylab.github.com/advisories/GHSL-2026-115_GHSL-2026-122_7-zip/
[email protected] - Exploit, Patch, Third Party Advisory
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.