7-Zip SquashFS Fragment Offset Integer Overflow Heap Memory Disclosure

CVE-2026-48092 is a heap memory disclosure vulnerability in 7-Zip's SquashFS handler affecting 32-bit builds of versions 9.18 through 26.00. The flaw is in the SquashFS ReadBlock function, where a 32-bit integer overflow involving attacker-controlled node.Offset can cause the calculation offsetInBlock + blockSize to wrap modulo 2^32. This overflow bypasses the fragment bounds check and leads to memcpy reading heap memory located before the cache buffer and copying it into the extracted output file. The issue is specific to 32-bit builds where size_t is 32 bits; on 64-bit builds the arithmetic is promoted to 64 bits and the malformed input is correctly rejected. The issue was fixed in 7-Zip 26.01.