7-Zip versions 9.11 through 26.00 contain a heap out-of-bounds read of up to 3 bytes in the UDF disc image handler's File Identifier Descriptor parser (CFileId::Parse in UdfIn.cpp). The vulnerability arises because an alignment-padding loop reads bytes beyond the allocated buffer before a bounds check is performed. This occurs when the sum of fixed and variable length fields results in a size that is exactly at the buffer boundary but not aligned to 4 bytes. The UDF handler processes .iso and .udf files and is triggered during file open operations when listing or extracting crafted UDF images. The impact is limited to information disclosure (via a 1-bit oracle per out-of-bounds byte) and denial of service (crash under hardened allocators). There is no write or code execution capability. The issue is fixed in version 26.01.

The vulnerability allows an attacker to cause a heap out-of-bounds read of up to 3 bytes, potentially leaking limited information through side-channel behavior and causing denial of service via application crashes under hardened memory allocators. There is no ability to write or execute arbitrary code. The impact is therefore limited to low-severity information disclosure and service disruption.

Upgrade 7-Zip to version 26.01 or later, where this vulnerability is fixed. No other mitigations are indicated or required.