P4Verified

CVE-2026-104086: 7-Zip 0 to before 26.03

CVE-2026-104086. CVSS 3.1 base score 5.5 (GitHub Advisory Database).

Affected technology

7-Zip · 0 to before 26.03
7-Zip

Description’s affected range: before 26.03

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Local · No privileges required · Passive user interaction

What an attacker can do

Attackers can cause the application to return uninitialized heap memory as the kpidUserId and kpidGroupId properties, exposing potentially sensitive process memory contents to the user. Vendor/CNA’s CVSS 4.0 assessment (base score 6.8/10) rates confidentiality impact as high; integrity and availability impact as none.

Published 14-Oct-2026 15:58 UTC

CWE: CWE-908
CCR priority: 22.0 /100 (P4)
CVSS 3.1: 5.5 /10 · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N · GitHub Advisory Database
KEV: no

Provenance

GitHub Advisory Database · Source record · observed 2026-10-14 16:01:16.619248+00:00 UTC
NVD CVE API 2.0 · Source record · observed 2026-10-14 15:56:36.793806+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-104086.html