7-Zip is a file archiver with a high compression ratio. Versions 9.18 through 26.00 contain an uninitialized heap read in the SquashFS archive handler caused by a sparsely populated index array. In the SquashFS handler, _blockToNode is allocated with capacity for every metadata block but populated only when an inode crosses a block boundary, so a crafted image with few inodes spanning many blocks leaves most slots holding raw heap contents (the underlying allocator does not zero-initialize POD storage). When OpenDir looks up an attacker-influenced blockIndex (derived from the RootInode superblock field), it reads two of these uninitialized slots and passes them as the left/right bounds of a binary search over _nodesPos, which dereferences the midpoint without bounds checking; if the resulting value happens to match the search key, the returned index is used to read a full node struct from _nodes whose fields feed further directory parsing, forming a chained OOB read primitive that is heap-layout-dependent and not reliably triggerable. The SquashFS handler is enabled by default in stock 7z.dll and the issue triggers during Open() with no interaction beyond opening the file; impact is denial of service from wild-pointer dereference and potential heap information disclosure, with no write primitive. Version 26.01 fixes the issue.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f36864b408 advisory.

    - Fixes CVE-2026-48092: Information disclosure in 32-bit builds
    - Fixes CVE-2026-48095: Arbitrary code execution in NTFS handler
    - Fixes CVE-2026-48101: Information disclosure in UEFI capsule parser
    - Fixes CVE-2026-48102: Information disclosure and DOS via crafted UDF       image
    - Fixes CVE-2026-48103: Off-by-one buffer over-read in WIM archive       handler
    - Fixes CVE-2026-48104: Uninitialized heap read in SquashFS archive       handler
    - Fixes CVE-2026-48111: Off-by-one OOB read in UEFI firmware image       parser
    - Fixes CVE-2026-48112: Heap-based buffer over-read in Ar handler BSD       SYMDEF parser


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4be7569210 advisory.

    - Fixes CVE-2026-48092: Information disclosure in 32-bit builds
    - Fixes CVE-2026-48095: Arbitrary code execution in NTFS handler
    - Fixes CVE-2026-48101: Information disclosure in UEFI capsule parser
    - Fixes CVE-2026-48102: Information disclosure and DOS via crafted UDF       image
    - Fixes CVE-2026-48103: Off-by-one buffer over-read in WIM archive       handler
    - Fixes CVE-2026-48104: Uninitialized heap read in SquashFS archive       handler
    - Fixes CVE-2026-48111: Off-by-one OOB read in UEFI firmware image       parser
    - Fixes CVE-2026-48112: Heap-based buffer over-read in Ar handler BSD       SYMDEF parser


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of 7-Zip installed on the remote Windows host is >= 9.18 and prior to 26.01. It is, therefore, affected by multiple vulnerabilities:

  - An out-of-bounds read exists in 7-Zip's SquashFS BlockToNode handling due to an uninitialized heap read,     which can lead to a crash when processing a crafted SquashFS archive. (CVE-2026-48104)

  - A path traversal vulnerability exists in 7-Zip's extraction mode that can lead to arbitrary file write when     extracting a crafted archive. (GHSL-2026-115)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - 7-Zip is a file archiver with a high compression ratio. Versions 9.18 through 26.00 contain an     uninitialized heap read in the SquashFS archive handler caused by a sparsely populated index array. In the     SquashFS handler, _blockToNode is allocated with capacity for every metadata block but populated only when     an inode crosses a block boundary, so a crafted image with few inodes spanning many blocks leaves most     slots holding raw heap contents (the underlying allocator does not zero-initialize POD storage). When     OpenDir looks up an attacker-influenced blockIndex (derived from the RootInode superblock field), it reads     two of these uninitialized slots and passes them as the left/right bounds of a binary search over
    _nodesPos, which dereferences the midpoint without bounds checking; if the resulting value happens to     match the search key, the returned index is used to read a full node struct from _nodes whose fields feed     further directory parsing, forming a chained OOB read primitive that is heap-layout-dependent and not     reliably triggerable. The SquashFS handler is enabled by default in stock 7z.dll and the issue triggers     during Open() with no interaction beyond opening the file; impact is denial of service from wild-pointer     dereference and potential heap information disclosure, with no write primitive. Version 26.01 fixes the     issue. (CVE-2026-48104)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
321161	Fedora 43 : 7zip (2026-f36864b408)	Nessus	Fedora Local Security Checks	high
321160	Fedora 44 : 7zip (2026-4be7569210)	Nessus	Fedora Local Security Checks	high
318789	7-Zip >= 9.18 < 26.01 SquashFS BlockToNode OOB Read (GHSL-2026-115_GHSL-2026-122)	Nessus	Windows	medium
317776	Linux Distros Unpatched Vulnerability : CVE-2026-48104	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-48104

medium

Tenable Plugins

high

high

medium

medium