Critical 7-Zip Vulnerabilities Allow Remote Code Execution

Key Takeaways

• A critical heap buffer overflow vulnerability (CVE-2026-48095) has been identified in 7-Zip.
• The flaw allows remote code execution (RCE) via a crafted NTFS archive, regardless of file extension.
• All 7-Zip versions up to and including 26.00 are affected, impacting both 32-bit and 64-bit systems.
• The vulnerability carries a CVSS 3.1 score of 8.8 (High).
• Users must update 7-Zip to a patched version immediately to mitigate the risk.

Critical 7-Zip Vulnerability Opens Door to Remote Code Execution

A severe heap buffer overflow vulnerability has been uncovered in 7-Zip, version 26.00 and earlier, posing a significant risk of remote code execution (RCE). This critical flaw, identified as CVE-2026-48095 (advisory GHSL-2026-140), stems from a defect within the archiving tool’s NTFS handler, which can be exploited through a vtable hijack.

Technical Deep Dive into the Flaw

The core of the vulnerability lies within the CInStream::GetCuSize() function, located in NtfsHandler.cpp. This function is responsible for calculating the size of the NTFS compression-unit buffer using a 32-bit shift operation: (UInt32)1 << (BlockSizeLog + CompressionUnit).

According to research by Jaroslav Lobačevski (@JarLob) of the GitHub Security Lab, the issue manifests when a specially crafted NTFS image sets ClusterSizeLog >= 28. If this condition is met, and a compressed data attribute contains CompressionUnit == 4, the shift exponent reaches 32. This triggers undefined behavior (UB) in C++. On x86 architectures, this UB causes the _inBuf to be incorrectly allocated as a mere single byte due to hardware masking of shift counts.

Immediately following this undersized allocation, a ReadStream_FALSE call attempts to write up to 256 MB of attacker-controlled data into the tiny 1-byte buffer. Since the CInStream object is allocated only 304 bytes after _inBuf on the heap, the initial 64 KB read iteration overwrites the object’s vtable pointer. A subsequent iteration then dispatches through this corrupted vtable, enabling a classic vtable hijack where the attacker gains full control over the overwritten pointer via the malicious NTFS cluster content.

Impact and Attack Surface

Both 32-bit and 64-bit versions of 7-Zip are susceptible to this vulnerability. On 64-bit systems equipped with 16 GB or more RAM, the _outBuf.Alloc(8 GB) call successfully completes, allowing the overflow to proceed directly to RCE. However, on systems with limited memory, an allocation failure may reduce the impact to a denial-of-service (DoS) condition.

A particularly concerning aspect of this flaw is its extension-agnostic attack surface. The NTFS handler employs signature-based fallback detection, specifically looking for the “NTFS ” signature at byte offset 3. This means that a malicious NTFS image, disguised with any common file extension—such as .7z, .zip, .rar, or even no extension at all—can still trigger the vulnerable handler. This occurs after the initial extension-matched handler rejects the file, making the attack highly versatile. Crucially, no user interaction beyond simply opening the crafted file is required for exploitation.

The vulnerability has been assigned a CVSS 3.1 score of 8.8 (High) with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. It is categorized under CWE-787 (Out-of-Bounds Write) and CWE-190 (Integer Overflow or Wraparound). All 7-Zip versions up to and including 26.00 are affected, as the flawed GetCuSize() computation has been present since NTFS compressed stream support was first introduced.

The vulnerability was discovered and responsibly reported by Jaroslav Lobačevski of the GitHub Security Lab. Confirmation was achieved using UBSan (UndefinedBehaviorSanitizer) under Clang on Linux x64, which pinpointed the root-cause shift UB at NtfsHandler.cpp:687, leading to a cascading invalid vtable dereference and ultimately a SIGSEGV.

What You Should Do

• Update Immediately: Users are strongly advised to update 7-Zip to a patched version as soon as one becomes available.
• Exercise Caution: Avoid opening untrusted archive files or disk images, regardless of their file extension, until your software has been updated.
• Implement Least Privilege: Ensure that users operate with the minimum necessary privileges to reduce the potential impact of successful exploitation.
• Monitor for Anomalies: Keep an eye on system logs and network traffic for any unusual activity that might indicate attempted exploitation.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.