Loading vulnerability…
Uninitialized heap read in the 7-Zip SquashFS handler
CVE-2026-48104 affects the SquashFS archive handler in 7-Zip versions 9.18 through 26.00. The handler allocates the _blockToNode index array for every metadata block but initializes entries only when an inode crosses a block boundary. A crafted SquashFS image with few inodes spanning many blocks can therefore leave entries containing uninitialized heap data. OpenDir uses a block index derived from the attacker-controlled RootInode superblock field to retrieve two such entries, then passes them as binary-search bounds over _nodesPos. The search dereferences its midpoint without bounds checking; a matching value can subsequently cause an out-of-bounds node-structure read that feeds further directory parsing. This heap-layout-dependent chain can cause denial of service and potentially disclose heap information when the archive is opened. Version 26.01 fixes the vulnerability.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Opening a crafted SquashFS image can crash the archive-processing application through a wild-pointer dereference and may disclose heap information through chained out-of-bounds reads. Triggering the read chain depends on heap layout and is not reliable. The vulnerability provides no write primitive; arbitrary code execution is not established.
If you can’t patch tonight, do this now.
For affected BigFix deployments, gather the updated BigFix Scanner and BigFix Inventory sites, stop open actions based on outdated Inventory fixlets, and restart them using updated fixlet versions. No separate vulnerability-specific workaround is established.
Patch, then assume compromise.
Upgrade 7-Zip to version 26.01 or later, including bundled copies used by other applications. For the identified distribution packages, update 7zip and related packages to 22.01+really26.01+dfsg-0+deb12u1 or later. In affected HCL deployments, upgrade BigFix Scanner to 11.0.43.0 or later on Windows endpoints and update BigFix Inventory actions to use version 11.0.8.0 of fixlets 20, 80, 2020, and 2021.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.