This vulnerability in 7-Zip arises from a 32-bit integer overflow in the SquashFS ReadBlock function on 32-bit builds where size_t is 32 bits. An attacker can supply a crafted node.Offset value that causes the addition offsetInBlock + blockSize to wrap modulo 2³², bypassing fragment bounds checks. Consequently, memcpy reads heap memory preceding the cache buffer, leading to a heap memory disclosure in the extracted file. The vulnerability is fixed in version 26.01, and 64-bit builds are not affected due to 64-bit integer promotion preventing the overflow.

The vulnerability allows an attacker to cause a heap memory disclosure on 32-bit builds of 7-Zip by exploiting an integer overflow in the SquashFS fragment offset calculation. This could lead to unintended data being included in extracted files. The CVSS score of 4.3 reflects a medium severity with no confidentiality or integrity impact, only limited availability impact. There are no known exploits in the wild at this time.

Upgrade affected 32-bit versions of 7-Zip to version 26.01 or later, where this vulnerability is patched. Since this is a client-side application and not a cloud service, users must apply the update themselves. Patch status is confirmed by the version information in the description. No additional mitigation steps are indicated by the vendor advisory.