CVE-2026-48095
Heap Buffer Overflow in 7-Zip
Publication date: 2026-06-05
Last updated on: 2026-06-05
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| 7-zip | 7-zip | to 26.01 (exc) |
| 7-zip | 7-zip | From 26.01 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
| CWE-190 | The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in 7-Zip allows for arbitrary code execution and application crashes due to a heap buffer overflow. This can lead to unauthorized access or manipulation of data during file extraction or testing, potentially compromising the confidentiality, integrity, and availability of sensitive information.
Such security risks can impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive data against unauthorized access and breaches. Exploitation of this vulnerability could result in data breaches or system compromises that violate these regulatory requirements.
Can you explain this vulnerability to me?
This vulnerability is a heap buffer overflow in 7-Zip version 26.00 caused by an under-allocation in the NTFS compressed stream buffer. It occurs due to undefined behavior in the GetCuSize() function, which calculates the buffer size using a 32-bit shift operation. When an attacker crafts an NTFS image with specific parameters (ClusterSizeLog >= 28 and CompressionUnit == 4), the shift operation results in the buffer being allocated as only 1 byte instead of the correct size.
During decompression, up to 256 MB of attacker-controlled data is written into this undersized buffer, causing a heap overflow. This overflow overwrites adjacent heap objects, including the vtable pointer of a stream object, enabling an attacker to hijack the vtable and potentially execute arbitrary code.
Both 32-bit and 64-bit builds of 7-Zip are affected, and the NTFS handler can be triggered by any file with a crafted NTFS signature, regardless of file extension. The issue was fixed in version 26.01.
How can this vulnerability impact me? :
This vulnerability can have severe impacts including arbitrary code execution and application crashes. An attacker can exploit the heap overflow to overwrite critical memory structures, such as the vtable pointer, allowing them to execute malicious code within the context of the 7-Zip application.
This could lead to full compromise of the system running the vulnerable 7-Zip version, unauthorized access to data, or denial of service through application crashes. The broad attack surface means that simply opening or testing a crafted file with a malicious NTFS signature can trigger the vulnerability.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by identifying the presence of 7-Zip version 26.00 or earlier on your system, as these versions contain the heap buffer overflow in the NTFS compressed stream buffer.
Detection can also involve scanning for files with crafted NTFS signatures that trigger the vulnerable NTFS handler in 7-Zip, regardless of file extension.
A proof-of-concept (PoC) generator exists to create malicious NTFS images exploiting this vulnerability, which can be used in controlled environments to test detection capabilities.
Suggested commands include checking the installed 7-Zip version via command line, for example:
- On Windows, run: 7z.exe --help or 7z.exe
- On Linux, run: 7z --help or 7z
Additionally, monitoring for suspicious NTFS image files or unusual extraction activity involving NTFS streams may help detect exploitation attempts.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade 7-Zip to version 26.01 or later, where this vulnerability has been fixed.
Until the upgrade can be applied, avoid extracting or testing files with NTFS signatures, especially those from untrusted sources, as the NTFS handler is enabled by default and can be triggered regardless of file extension.
Implement network and endpoint monitoring to detect and block malicious NTFS images that could exploit this vulnerability.