DEBIAN-CVE-2026-104086
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-104086
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-104086.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-104086
- Upstream
- CVE-2026-104086
- Published
- 2026-10-14T14:17:30Z
- Modified
- 2026-10-18T00:00:07Z
- Severity
-
- 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- [none]
- Details
-
7-Zip before 26.03 contains an uninitialized memory disclosure vulnerability in the SquashFS v4 archive handler (SquashfsHandler.cpp) that allows attackers to leak heap memory by crafting a malicious archive where the superblock’s no_ids field is set so that the final metadata block’s expected size is miscomputed and bypasses the size validation check. By listing or extracting the crafted archive, attackers can cause the application to return uninitialized heap memory as the kpidUserId and kpidGroupId properties, exposing potentially sensitive process memory contents to the user.
- References
Affected packages
Debian:12 / 7zip
Package
- Name
- 7zip
- Purl
- pkg:deb/debian/7zip?arch=source&distro=bookworm
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Affected versions
22.*
22.01+dfsg-8
22.01+dfsg-8+deb12u1
22.01+dfsg-9
22.01+dfsg-10~exp1
22.01+really25.01+dfsg-0+deb12u1
22.01+really26.01+dfsg-0+deb12u1
22.01+really26.02+dfsg-0+deb12u1
23.*
23.01+dfsg-1
23.01+dfsg-2
23.01+dfsg-3
23.01+dfsg-4~exp1
23.01+dfsg-4
23.01+dfsg-5
23.01+dfsg-6
23.01+dfsg-7
23.01+dfsg-8
23.01+dfsg-9
23.01+dfsg-10
23.01+dfsg-11
23.01+dfsg-12
24.*
24.05+dfsg-1
24.05+dfsg-2
24.05+dfsg-3
24.06+dfsg-1
24.06+dfsg-2
24.06+dfsg-3
24.06+dfsg-4
24.07+dfsg-1
24.07+dfsg-2
24.08+dfsg-1~bpo12+1
24.08+dfsg-1
24.08+dfsg-2
24.09+dfsg-1
24.09+dfsg-2~bpo12+1
24.09+dfsg-2
24.09+dfsg-3
24.09+dfsg-4
24.09+dfsg-5
24.09+dfsg-6
24.09+dfsg-7~bpo12+1
24.09+dfsg-7
24.09+dfsg-8~bpo12+1
24.09+dfsg-8
25.*
25.00+dfsg-1
25.01+dfsg-1~deb13u1~bpo12+1
25.01+dfsg-1~deb13u1
25.01+dfsg-1~deb13u2
25.01+dfsg-1
25.01+dfsg-2
25.01+dfsg-3
25.01+dfsg-4
25.01+dfsg-5
26.*
26.00+dfsg-1
26.00+dfsg-2
26.00+dfsg-3
26.00+dfsg-4
26.00+dfsg-5
26.00+dfsg1-1
26.00+dfsg1-2
26.00+dfsg1-3
26.01+dfsg-1
26.01+dfsg-2
26.01+dfsg-3
26.02+dfsg-1
26.02+dfsg-2
26.02+dfsg-3
26.03+dfsg-1
26.03+dfsg-2
26.03+dfsg-3
26.04+dfsg-1
Debian:13 / 7zip
Package
- Name
- 7zip
- Purl
- pkg:deb/debian/7zip?arch=source&distro=trixie
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Affected versions
24.*
24.09+dfsg-8
25.*
25.00+dfsg-1
25.01+dfsg-1~deb13u1~bpo12+1
25.01+dfsg-1~deb13u1
25.01+dfsg-1~deb13u2
25.01+dfsg-1
25.01+dfsg-2
25.01+dfsg-3
25.01+dfsg-4
25.01+dfsg-5
26.*
26.00+dfsg-1
26.00+dfsg-2
26.00+dfsg-3
26.00+dfsg-4
26.00+dfsg-5
26.00+dfsg1-1
26.00+dfsg1-2
26.00+dfsg1-3
26.01+dfsg-1
26.01+dfsg-2
26.01+dfsg-3
26.02+dfsg-1
26.02+dfsg-2
26.02+dfsg-3
26.03+dfsg-1
26.03+dfsg-2
26.03+dfsg-3
26.04+dfsg-1
Debian:14 / 7zip
Package
- Name
- 7zip
- Purl
- pkg:deb/debian/7zip?arch=source&distro=forky
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed26.03+dfsg-1
Affected versions
24.*
24.09+dfsg-8
25.*
25.00+dfsg-1
25.01+dfsg-1~deb13u1~bpo12+1
25.01+dfsg-1~deb13u1
25.01+dfsg-1~deb13u2
25.01+dfsg-1
25.01+dfsg-2
25.01+dfsg-3
25.01+dfsg-4
25.01+dfsg-5
26.*
26.00+dfsg-1
26.00+dfsg-2
26.00+dfsg-3
26.00+dfsg-4
26.00+dfsg-5
26.00+dfsg1-1
26.00+dfsg1-2
26.00+dfsg1-3
26.01+dfsg-1
26.01+dfsg-2
26.01+dfsg-3
26.02+dfsg-1
26.02+dfsg-2
26.02+dfsg-3
Debian:12 / p7zip
Package
- Name
- p7zip
- Purl
- pkg:deb/debian/p7zip?arch=source&distro=bookworm
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Debian:13 / p7zip
Package
- Name
- p7zip
- Purl
- pkg:deb/debian/p7zip?arch=source&distro=trixie