Loading vulnerability…
7-Zip SquashFS Fragment Offset Overflow Heap Disclosure
CVE-2026-48092 is an integer-overflow vulnerability in the SquashFS ReadBlock function of 32-bit 7-Zip builds. An attacker-controlled node.Offset causes offsetInBlock + blockSize to wrap modulo 2³², bypassing the fragment bounds check. A subsequent memcpy reads heap memory preceding the cache buffer and copies it into an extracted file. Versions 9.34 through 26.00 are affected, with conflicting affected-version information extending the range to 9.18. The vulnerability does not affect 64-bit builds, where the addition uses 64-bit arithmetic and the bounds check rejects the malicious input. Version 26.01 fixes the issue.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Extraction of a malicious SquashFS image can disclose process heap memory by embedding bytes preceding an internal cache buffer in the extracted output. This compromises the confidentiality of memory exposed by the out-of-bounds read. The disclosed data and its sensitivity depend on the heap contents at extraction time.
If you can’t patch tonight, do this now.
Use a 64-bit build of 7-Zip to avoid this specific overflow: its 64-bit arithmetic preserves the bounds check. For BigFix deployments, gather the updated Scanner and Inventory sites and stop outdated Inventory actions before restarting them with updated fixlets; no separate BigFix workaround is identified.
Patch, then assume compromise.
Upgrade 7-Zip to version 26.01 or later. For the identified distribution packages, update the 7zip library and related packages to 22.01+really26.01+dfsg-0+deb12u1 or later. For affected bundled components on Windows, upgrade BigFix Scanner to 11.0.43.0 or later using updated fixlets. For BigFix Inventory, gather the updated site, stop actions based on fixlets 20, 80, 2020, and 2021, and restart them using fixlet version 11.0.8.0.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.