CVE-2026-48104 Overview
CVE-2026-48104 is an uninitialized heap read vulnerability in the SquashFS archive handler of 7-Zip, a widely deployed file archiver. Versions 9.18 through 26.00 are affected. The flaw resides in the _blockToNode index array, which the handler allocates with capacity for every metadata block but only populates when an inode crosses a block boundary. A crafted SquashFS image containing few inodes that span many blocks leaves most slots holding raw heap contents because the allocator does not zero-initialize plain-old-data storage. The SquashFS handler is enabled by default in stock 7z.dll, and the issue triggers during Open() with no interaction beyond opening the file. The vulnerability is tracked under [CWE-125] (Out-of-bounds Read).
Critical Impact
Opening a malicious SquashFS archive can cause denial of service from a wild-pointer dereference and may disclose heap memory contents. No write primitive exists.
Affected Products
- 7-Zip version 9.18 through 26.00
- Stock 7z.dll with default SquashFS handler enabled
- Applications and shells embedding the affected 7-Zip library
Discovery Timeline
- 2026-06-05 - CVE-2026-48104 published to NVD
- 2026-06-08 - Last updated in NVD database
Technical Details for CVE-2026-48104
Vulnerability Analysis
The SquashFS handler in 7-Zip maintains an index array named _blockToNode that maps metadata blocks to node positions. The handler sizes this array to accommodate every metadata block in the archive. However, the code only writes entries when an inode crosses a block boundary. For images with few inodes spread across many blocks, most array slots remain unwritten. The underlying allocator returns uninitialized memory for these POD slots, so the unwritten entries contain residual heap data from prior allocations.
When OpenDir processes a directory lookup, it computes a blockIndex derived from the RootInode field of the SquashFS superblock. The handler reads two slots from _blockToNode at attacker-influenced offsets and treats them as the left and right bounds of a binary search over _nodesPos. The binary search dereferences the midpoint without validating that the bounds are within _nodesPos. If the midpoint value matches the search key by coincidence, the returned index is used to read a full node struct from _nodes. Subsequent directory parsing consumes those fields, forming a chained out-of-bounds read primitive.
Root Cause
The root cause is failure to zero-initialize the _blockToNode index array. The handler assumes every slot is populated before use, but the population path runs only on block boundary crossings. Combined with the absence of bounds validation on the binary search inputs, this allows uninitialized heap content to drive subsequent memory accesses.
Attack Vector
An attacker crafts a SquashFS image with a sparse inode layout and a manipulated RootInode superblock field. The victim opens the file with 7-Zip or any application using 7z.dll. The exploitation is heap-layout-dependent and not reliably triggerable, limiting it to denial of service and probabilistic heap information disclosure. The handler is enabled by default and requires no user interaction beyond opening the archive. See the GitHub Security Advisory GHSL-2026-115_GHSL-2026-122 for the full technical write-up.
Detection Methods for CVE-2026-48104
Indicators of Compromise
- SquashFS archives with abnormally small inode counts relative to metadata block count
- Process crashes in 7z.exe, 7zG.exe, or applications loading 7z.dll shortly after opening .sfs, .squashfs, or container files containing SquashFS streams
- Unexpected memory access violations originating from the SquashFS handler within 7-Zip processes
Detection Strategies
- Inspect SquashFS superblocks for RootInode values that point to high block indices with sparse inode population
- Monitor endpoints for repeated 7-Zip process crashes correlated with archive open events
- Apply file inventory rules that flag 7-Zip installations older than version 26.01
Monitoring Recommendations
- Log archive extraction events from email gateways, file shares, and user download directories
- Alert on 7z.dll faults captured by Windows Error Reporting or equivalent crash telemetry
- Track endpoint software inventory to identify hosts running vulnerable 7-Zip builds between 9.18 and 26.00
How to Mitigate CVE-2026-48104
Immediate Actions Required
- Upgrade all 7-Zip installations to version 26.01 or later, which contains the fix
- Identify embedded uses of 7z.dll in third-party applications and update bundled libraries
- Block inbound SquashFS archives at email and web gateways until patching is complete
Patch Information
Version 26.01 fixes the issue by correcting the population and bounds handling around _blockToNode. Refer to the GitHub Security Advisory GHSL-2026-115_GHSL-2026-122 for vendor details. Replace 7z.dll in any application that ships a private copy of the library.
Workarounds
- Disable or unregister the SquashFS handler in deployments where it is not required
- Restrict 7-Zip usage on untrusted archives by routing extraction through sandboxed or containerized workers
- Apply application allowlisting to prevent unpatched 7-Zip binaries from executing
# Verify installed 7-Zip version on Windows
7z.exe | findstr /R "^7-Zip"
# Verify installed 7-Zip version on Linux
7z | head -n 2
# Expected output should show version 26.01 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
