The vulnerability is a heap out-of-bounds read of up to 3 bytes in the UDF disc image handler component of 7-Zip, specifically in the CFileId::Parse function. The issue arises because the alignment-padding loop reads bytes beyond the allocated buffer before a bounds check is performed, when the buffer size is exactly aligned such that (38 + impLen + idLen) % 4 != 0 and equals the buffer size. This flaw affects 7-Zip versions from 9.11 up to but not including 26.01. The UDF handler processes .iso and .udf files and is triggered during the Open() operation when listing or extracting files. The impact is limited to information disclosure (via a 1-bit oracle per out-of-bounds byte) and denial of service through crashes under hardened memory allocators. There is no write or code execution capability. The issue is fixed in version 26.01.

The vulnerability allows an attacker to cause a heap out-of-bounds read of up to 3 bytes, which can lead to limited information disclosure through a 1-bit oracle per out-of-bounds byte. Additionally, it can cause denial of service by crashing the application under hardened memory allocators. There is no impact on integrity or availability beyond these effects, and no write or code execution is possible.

Version 26.01 of 7-Zip fixes this vulnerability. Users should upgrade to 7-Zip 26.01 or later to remediate the issue. No other mitigation or workaround is indicated by the vendor advisory or available data.