CVE-2026-48092
Published: June 5th, 2026
7-Zip is a file archiver with a high compression ratio. Versions 9.34 through 26.00 contain a heap memory disclosure via SquashFS fragment offset integer overflow on 32-bit builds. 32-bit integer overflow in the SquashFS ReadBlock function allows an attacker-controlled node.Offset value to bypass the fragment bounds check, causing memcpy to read heap memory preceding the cache buffer into the extracted file. The vulnerability is exploitable only on 32-bit builds of 7-Zip where size_t is 32 bits, allowing the addition offsetInBlock + blockSize to wrap modulo 2³². On 64-bit builds the addition is promoted to 64 bits and the check correctly rejects the input. Version 26.01 patches the issue.
MEDIUM
CVSS v3: 4.3
CVSS v3: 4.3
Status
| DocFilters Release | Package | State | Justification | Comment |
|---|---|---|---|---|
| 26.3 | 7-zip (23.01) | Not Affected | Code Not Present | The vulnerability exists in the SquashFS handler (ReadBlock in SquashfsHandler.cpp), which is part of the full 7-Zip application and is not present in the LZMA SDK. Document Filters consumes LZMA SDK 23.01, whose Archive directory ships only the 7z, LZMA, XZ, and Split handlers; SquashfsHandler.cpp does not exist in the SDK distribution and is not included in the Document Filters build source list (external/CMakeLists.txt). The vulnerable ReadBlock function is therefore never compiled or reachable. Additionally, the flaw is exploitable only on 32-bit builds where size_t is 32 bits; Document Filters ships 64-bit builds where the offsetInBlock + blockSize addition is promoted to 64 bits and the bounds check correctly rejects the input. |
| 26.2 | 7-zip (23.01) | Not Affected | Code Not Present | The vulnerability exists in the SquashFS handler (ReadBlock in SquashfsHandler.cpp), which is part of the full 7-Zip application and is not present in the LZMA SDK. Document Filters consumes LZMA SDK 23.01, whose Archive directory ships only the 7z, LZMA, XZ, and Split handlers; SquashfsHandler.cpp does not exist in the SDK distribution and is not included in the Document Filters build source list (external/CMakeLists.txt). The vulnerable ReadBlock function is therefore never compiled or reachable. Additionally, the flaw is exploitable only on 32-bit builds where size_t is 32 bits; Document Filters ships 64-bit builds where the offsetInBlock + blockSize addition is promoted to 64 bits and the bounds check correctly rejects the input. |
| 26.1 | 7-zip (23.01) | Not Affected | Code Not Present | The vulnerability exists in the SquashFS handler (ReadBlock in SquashfsHandler.cpp), which is part of the full 7-Zip application and is not present in the LZMA SDK. Document Filters consumes LZMA SDK 23.01, whose Archive directory ships only the 7z, LZMA, XZ, and Split handlers; SquashfsHandler.cpp does not exist in the SDK distribution and is not included in the Document Filters build source list (external/CMakeLists.txt). The vulnerable ReadBlock function is therefore never compiled or reachable. Additionally, the flaw is exploitable only on 32-bit builds where size_t is 32 bits; Document Filters ships 64-bit builds where the offsetInBlock + blockSize addition is promoted to 64 bits and the bounds check correctly rejects the input. |
| 25.4 | 7-zip (23.01) | Not Affected | Code Not Present | The vulnerability exists in the SquashFS handler (ReadBlock in SquashfsHandler.cpp), which is part of the full 7-Zip application and is not present in the LZMA SDK. Document Filters consumes LZMA SDK 23.01, whose Archive directory ships only the 7z, LZMA, XZ, and Split handlers; SquashfsHandler.cpp does not exist in the SDK distribution and is not included in the Document Filters build source list (external/CMakeLists.txt). The vulnerable ReadBlock function is therefore never compiled or reachable. Additionally, the flaw is exploitable only on 32-bit builds where size_t is 32 bits; Document Filters ships 64-bit builds where the offsetInBlock + blockSize addition is promoted to 64 bits and the bounds check correctly rejects the input. |
| 25.3 | 7-zip (23.01) | Not Affected | Code Not Present | The vulnerability exists in the SquashFS handler (ReadBlock in SquashfsHandler.cpp), which is part of the full 7-Zip application and is not present in the LZMA SDK. Document Filters consumes LZMA SDK 23.01, whose Archive directory ships only the 7z, LZMA, XZ, and Split handlers; SquashfsHandler.cpp does not exist in the SDK distribution and is not included in the Document Filters build source list (external/CMakeLists.txt). The vulnerable ReadBlock function is therefore never compiled or reachable. Additionally, the flaw is exploitable only on 32-bit builds where size_t is 32 bits; Document Filters ships 64-bit builds where the offsetInBlock + blockSize addition is promoted to 64 bits and the bounds check correctly rejects the input. |
| 25.2 | 7-zip (23.01) | Not Affected | Code Not Present | The vulnerability exists in the SquashFS handler (ReadBlock in SquashfsHandler.cpp), which is part of the full 7-Zip application and is not present in the LZMA SDK. Document Filters consumes LZMA SDK 23.01, whose Archive directory ships only the 7z, LZMA, XZ, and Split handlers; SquashfsHandler.cpp does not exist in the SDK distribution and is not included in the Document Filters build source list (external/CMakeLists.txt). The vulnerable ReadBlock function is therefore never compiled or reachable. Additionally, the flaw is exploitable only on 32-bit builds where size_t is 32 bits; Document Filters ships 64-bit builds where the offsetInBlock + blockSize addition is promoted to 64 bits and the bounds check correctly rejects the input. |
| 25.1 | 7-zip (23.01) | Not Affected | Code Not Present | The vulnerability exists in the SquashFS handler (ReadBlock in SquashfsHandler.cpp), which is part of the full 7-Zip application and is not present in the LZMA SDK. Document Filters consumes LZMA SDK 23.01, whose Archive directory ships only the 7z, LZMA, XZ, and Split handlers; SquashfsHandler.cpp does not exist in the SDK distribution and is not included in the Document Filters build source list (external/CMakeLists.txt). The vulnerable ReadBlock function is therefore never compiled or reachable. Additionally, the flaw is exploitable only on 32-bit builds where size_t is 32 bits; Document Filters ships 64-bit builds where the offsetInBlock + blockSize addition is promoted to 64 bits and the bounds check correctly rejects the input. |
| 24.4 | 7-zip (23.01) | Not Affected | Code Not Present | The vulnerability exists in the SquashFS handler (ReadBlock in SquashfsHandler.cpp), which is part of the full 7-Zip application and is not present in the LZMA SDK. Document Filters consumes LZMA SDK 23.01, whose Archive directory ships only the 7z, LZMA, XZ, and Split handlers; SquashfsHandler.cpp does not exist in the SDK distribution and is not included in the Document Filters build source list (external/CMakeLists.txt). The vulnerable ReadBlock function is therefore never compiled or reachable. Additionally, the flaw is exploitable only on 32-bit builds where size_t is 32 bits; Document Filters ships 64-bit builds where the offsetInBlock + blockSize addition is promoted to 64 bits and the bounds check correctly rejects the input. |
| 24.4.0 | 7-zip (23.01) | Not Affected | Code Not Present | The vulnerability exists in the SquashFS handler (ReadBlock in SquashfsHandler.cpp), which is part of the full 7-Zip application and is not present in the LZMA SDK. Document Filters consumes LZMA SDK 23.01, whose Archive directory ships only the 7z, LZMA, XZ, and Split handlers; SquashfsHandler.cpp does not exist in the SDK distribution and is not included in the Document Filters build source list (external/CMakeLists.txt). The vulnerable ReadBlock function is therefore never compiled or reachable. Additionally, the flaw is exploitable only on 32-bit builds where size_t is 32 bits; Document Filters ships 64-bit builds where the offsetInBlock + blockSize addition is promoted to 64 bits and the bounds check correctly rejects the input. |
| 24.3 | 7-zip (23.01) | Not Affected | Code Not Present | The vulnerability exists in the SquashFS handler (ReadBlock in SquashfsHandler.cpp), which is part of the full 7-Zip application and is not present in the LZMA SDK. Document Filters consumes LZMA SDK 23.01, whose Archive directory ships only the 7z, LZMA, XZ, and Split handlers; SquashfsHandler.cpp does not exist in the SDK distribution and is not included in the Document Filters build source list (external/CMakeLists.txt). The vulnerable ReadBlock function is therefore never compiled or reachable. Additionally, the flaw is exploitable only on 32-bit builds where size_t is 32 bits; Document Filters ships 64-bit builds where the offsetInBlock + blockSize addition is promoted to 64 bits and the bounds check correctly rejects the input. |
| 24.2 | 7-zip (23.01) | Not Affected | Code Not Present | The vulnerability exists in the SquashFS handler (ReadBlock in SquashfsHandler.cpp), which is part of the full 7-Zip application and is not present in the LZMA SDK. Document Filters consumes LZMA SDK 23.01, whose Archive directory ships only the 7z, LZMA, XZ, and Split handlers; SquashfsHandler.cpp does not exist in the SDK distribution and is not included in the Document Filters build source list (external/CMakeLists.txt). The vulnerable ReadBlock function is therefore never compiled or reachable. Additionally, the flaw is exploitable only on 32-bit builds where size_t is 32 bits; Document Filters ships 64-bit builds where the offsetInBlock + blockSize addition is promoted to 64 bits and the bounds check correctly rejects the input. |
| 24.1 | 7-zip (23.01) | Not Affected | Code Not Present | The vulnerability exists in the SquashFS handler (ReadBlock in SquashfsHandler.cpp), which is part of the full 7-Zip application and is not present in the LZMA SDK. Document Filters consumes LZMA SDK 23.01, whose Archive directory ships only the 7z, LZMA, XZ, and Split handlers; SquashfsHandler.cpp does not exist in the SDK distribution and is not included in the Document Filters build source list (external/CMakeLists.txt). The vulnerable ReadBlock function is therefore never compiled or reachable. Additionally, the flaw is exploitable only on 32-bit builds where size_t is 32 bits; Document Filters ships 64-bit builds where the offsetInBlock + blockSize addition is promoted to 64 bits and the bounds check correctly rejects the input. |
| 23.3 | 7-zip (23.01) | Not Affected | Code Not Present | The vulnerability exists in the SquashFS handler (ReadBlock in SquashfsHandler.cpp), which is part of the full 7-Zip application and is not present in the LZMA SDK. Document Filters consumes LZMA SDK 23.01, whose Archive directory ships only the 7z, LZMA, XZ, and Split handlers; SquashfsHandler.cpp does not exist in the SDK distribution and is not included in the Document Filters build source list (external/CMakeLists.txt). The vulnerable ReadBlock function is therefore never compiled or reachable. Additionally, the flaw is exploitable only on 32-bit builds where size_t is 32 bits; Document Filters ships 64-bit builds where the offsetInBlock + blockSize addition is promoted to 64 bits and the bounds check correctly rejects the input. |
| 23.2 | 7-zip (17.01) | Not Affected | Code Not Present | The vulnerability exists in the SquashFS handler (ReadBlock in SquashfsHandler.cpp), which is part of the full 7-Zip application and is not present in the LZMA SDK. Document Filters consumes LZMA SDK 23.01, whose Archive directory ships only the 7z, LZMA, XZ, and Split handlers; SquashfsHandler.cpp does not exist in the SDK distribution and is not included in the Document Filters build source list (external/CMakeLists.txt). The vulnerable ReadBlock function is therefore never compiled or reachable. Additionally, the flaw is exploitable only on 32-bit builds where size_t is 32 bits; Document Filters ships 64-bit builds where the offsetInBlock + blockSize addition is promoted to 64 bits and the bounds check correctly rejects the input. |
| 23.1 | 7-zip (17.01) | Not Affected | Code Not Present | The vulnerability exists in the SquashFS handler (ReadBlock in SquashfsHandler.cpp), which is part of the full 7-Zip application and is not present in the LZMA SDK. Document Filters consumes LZMA SDK 23.01, whose Archive directory ships only the 7z, LZMA, XZ, and Split handlers; SquashfsHandler.cpp does not exist in the SDK distribution and is not included in the Document Filters build source list (external/CMakeLists.txt). The vulnerable ReadBlock function is therefore never compiled or reachable. Additionally, the flaw is exploitable only on 32-bit builds where size_t is 32 bits; Document Filters ships 64-bit builds where the offsetInBlock + blockSize addition is promoted to 64 bits and the bounds check correctly rejects the input. |
| 22.4 | 7-zip (17.01) | Not Affected | Code Not Present | The vulnerability exists in the SquashFS handler (ReadBlock in SquashfsHandler.cpp), which is part of the full 7-Zip application and is not present in the LZMA SDK. Document Filters consumes LZMA SDK 23.01, whose Archive directory ships only the 7z, LZMA, XZ, and Split handlers; SquashfsHandler.cpp does not exist in the SDK distribution and is not included in the Document Filters build source list (external/CMakeLists.txt). The vulnerable ReadBlock function is therefore never compiled or reachable. Additionally, the flaw is exploitable only on 32-bit builds where size_t is 32 bits; Document Filters ships 64-bit builds where the offsetInBlock + blockSize addition is promoted to 64 bits and the bounds check correctly rejects the input. |
Severity score breakdown
Attack Complexity
LOW
Attack Vector
NETWORK
Availability Impact
LOW
Base Score
4.3
Base Severity
MEDIUM
Confidentiality Impact
NONE
Integrity Impact
NONE
Privileges Required
NONE
Scope
UNCHANGED
User Interaction
REQUIRED
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Version
3.1