7-Zip versions 9.34 through 26.00 contain an off-by-one heap out-of-bounds read in the WIM archive handler's security descriptor lookup function (CHandler::GetSecurity). The vulnerability arises because the check on securityId allows it to equal numEntries, leading to a read one UInt32 past the end of the SecurOffsets array. The securityId is attacker-controlled within WIM metadata directory entries. This vulnerability affects file types .wim, .swm, .esd, and .ppkg and can be triggered during archive listing in both GUI and CLI. The out-of-bounds read results in denial of service under hardened allocators and minor information disclosure, but no write or code execution is possible.

The vulnerability allows an attacker to cause a denial of service by triggering an out-of-bounds read in the 7-Zip WIM archive handler. Minor information disclosure is possible due to the out-of-bounds value being used arithmetically as a length, but this value is not directly exposed to the attacker. There is no ability to write to memory or execute arbitrary code. The attack can be triggered without user interaction when listing archive contents.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when opening or listing WIM, SWM, ESD, and PPKG archive files from untrusted sources. No specific vendor mitigation or workaround has been provided at this time.