7-Zip versions 9.18 to 26.00 contain an uninitialized heap read vulnerability in the SquashFS archive handler. The vulnerability occurs because the _blockToNode array is allocated for every metadata block but only partially populated, leaving many entries uninitialized. When OpenDir uses an attacker-controlled blockIndex derived from the RootInode superblock field, it reads uninitialized slots as bounds for a binary search, which can lead to out-of-bounds reads and heap information disclosure. This vulnerability triggers during file open operations without further user interaction. The impact includes denial of service from wild-pointer dereference and potential information disclosure. Version 26.01 addresses this issue.

The vulnerability can cause denial of service due to wild-pointer dereference and may lead to heap information disclosure. There is no write or code execution capability associated with this flaw. Exploitation requires opening a specially crafted SquashFS archive file. No known exploits have been reported in the wild.

Version 26.01 of 7-Zip fixes this vulnerability. Users should upgrade to 7-Zip 26.01 or later to remediate this issue. Since this is not a cloud service, remediation depends on user action to update the software. Patch status is not explicitly confirmed in the vendor advisory, but the description states the issue is fixed in version 26.01.