7-Zip versions 9.34 through 26.00 on 32-bit architectures contain a heap memory disclosure vulnerability caused by a 32-bit integer overflow in the SquashFS ReadBlock function. The overflow occurs when adding offsetInBlock and blockSize, allowing the sum to wrap modulo 2³². This enables an attacker-controlled node.Offset value to bypass fragment bounds checks, leading to memcpy reading heap memory preceding the cache buffer into the extracted file. The vulnerability does not affect 64-bit builds because the addition is promoted to 64 bits, preventing the overflow. Version 26.01 of 7-Zip patches this issue.

The vulnerability allows an attacker to cause a heap memory disclosure on 32-bit builds of 7-Zip by exploiting an integer overflow in the SquashFS fragment offset calculation. This can lead to unintended memory being read and included in extracted files, potentially exposing sensitive information. There is no indication of code execution or integrity impact. The CVSS score of 4.3 reflects a medium severity with network attack vector, low complexity, no privileges required, user interaction required, and limited impact to availability only.

Upgrade affected 32-bit versions of 7-Zip to version 26.01 or later, where this vulnerability is patched. No other mitigation or temporary fix is indicated. For 64-bit builds, this vulnerability does not apply due to architectural differences.