7-Zip 26.00: Any .zip File Can Trigger the Most Severe Heap…

CVE-2026-48095 is a heap overflow in 7-Zip's NTFS parser caused by undefined behavior in a 32-bit shift. An apparently harmless archive can allocate a 1-byte buffer and then overwrite up to 256 MB with attacker-controlled data, enabling vtable hijacking and potential code execution.

On April 27, 2026, Igor Pavlov released 7-Zip 26.01 with a fix for a heap buffer overflow in the NTFS parser. The GitHub Security Lab, led by researcher Jaroslav Lobačevski (@JarLob), had delivered the private report three days earlier, on April 24, 2026. The speed of the response should not obscure the severity: the bug allows a seemingly innocuous archive file to allocate a 1-byte buffer and then overwrite up to 256 MB with attacker-controlled data, resulting in memory corruption and potential code execution via vtable hijacking.

Key Takeaways

The bug resides in the CInStream::GetCuSize() function of 7-Zip's NTFS handler, where a 32-bit shift with an exponent ≥ 32 triggers undefined behavior leading to a 1-byte under-allocation
Opening a single file with a .zip, .7z, .rar, or even no extension can trigger the vulnerable NTFS parser due to the signature-based fallback mechanism
The proof-of-concept gen_ntfs_sparse.py is public: it generates a 512 MB sparse NTFS image (~8 KB actual) that triggers the crash and demonstrates vtable hijacking
The CVSS base score is 8.8 (High) per GitHub Security Lab and NVD, vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; Amazon Linux assigns 7.8 with AV:L, reflecting local attack contexts

The Mechanism: From a C++ Shift to 256 MB of Controlled Corruption

The root cause is a C++ shift expression that enters undefined behavior territory. In the CInStream::GetCuSize() function, the code calculates the input buffer size as (UInt32)1 << (BlockSizeLog + CompressionUnit). When BlockSizeLog == 28 and CompressionUnit == 4, the exponent becomes 32 — equal to the width of the UInt32 type. Per the C++ standard, a shift of this nature is undefined behavior: the compiler guarantees no specific result.

On x86 and x64 architectures, the hardware masks the shift count to 5 bits, typically producing the value 1 instead of the expected 4,294,967,296. This 1 propagates to the call _inBuf.Alloc(1), which allocates exactly one byte. The subsequent read, however, calculates const size_t compressed = (size_t)numChunks << BlockSizeLog, where numChunks can reach values that generate a write of up to 256 MB of attacker-controlled data into the 1-byte buffer.

The GitHub Security Lab documented the exploit chain with textbook precision. In release builds with /O1 optimization, the CInStream object is allocated 304 bytes (0x130) after _inBuf on the heap. The first Read() iteration writes 64 KB of controlled data: after 304 bytes, it overwrites the vtable pointer of the adjacent object. The second Read() iteration dispatches through the corrupted vtable, achieving a classic vtable hijack. This is not a theoretical crash: it is a concrete memory-corruption primitive with code execution demonstrated in the report context.

"A heap buffer overflow vulnerability (GHSL-2026-140) exists in 7-Zip version 26.00, caused by an under-allocation in the NTFS compressed stream buffer (`GetCuSize` shift UB), potentially allowing attackers to exploit this issue for arbitrary code execution or application crashes." — GitHub Security Lab, advisory GHSL-2026-140

The Extension Illusion: Why .zip Does Not Protect You

The attack surface defies the intuition of the average user — and most system administrators — due to an architectural behavior of 7-Zip that rarely receives attention. The NTFS handler is not triggered only by files with .ntfs or .img extensions: the software uses signature-based detection with a fallback mechanism when the extension-associated handler fails. The signature 'NTFS ' is searched at byte offset 3.

The result is that a crafted NTFS image with a .7z, .zip, .rar, or even no extension is opened by the NTFS handler after the initial handler rejects the format. A user receiving an email attachment with a familiar extension has, in this case, no visual indicator of danger. The attack path requires user interaction (UI:R in the CVSS vector), but does not require the victim to intentionally open an NTFS file: a double-click on what appears to be an ordinary archive is sufficient.

This characteristic amplifies operational risk in an underestimated way. Security gateways, malware analysis sandboxes, CI/CD pipelines that automatically extract archives, and endpoint management tools that embed 7-Zip as a decompression utility can all trigger the NTFS parser without the file extension suggesting it. The logic of "extension equals parser" is not reliable in this specific case.

The CVSS Discrepancy: 8.8 vs. 7.8 and the Meaning of Attack Contexts

The scoring data shows a divergence that warrants explicit explanation. The GitHub Security Lab and the National Vulnerability Database record a CVSS 3.1 base score of 8.8 with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating a network attack vector. Amazon Linux, in advisory ALAS2023-2026-1820, assigns 7.8 with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, where the AV:L (Attack Vector: Local) parameter reflects a context in which the attacker must already have local access to the target system.

Both scores share the same qualitative severity (High) and the same impacts on confidentiality, integrity, and availability. The numerical difference does not indicate uncertainty about the technical mechanism — that is convergent and documented — but rather the variability of the operational context in which the malicious file is delivered and opened. For organizations with endpoints exposed to untrusted remote content (email, web downloads, file sharing), the 8.8 profile is the more appropriate reference.

What to Do Now

Inventory all 7-Zip installations in the enterprise environment, with particular attention to portable versions, VM templates, and forensic tools that embed static binaries: version 26.00 and earlier are vulnerable; 26.01 fixes the bug
Segment untrusted file flows: gateways that automatically decompress attachments must be verified for the presence of 7-Zip 26.00 or earlier, regardless of the file type in transit
Evaluate deployment of version 26.02 (released June 25, 2026) for new deployments, maintaining 26.01 as the absolute security minimum
Explicitly verify p7zip builds on Linux systems: Amazon Linux 2 has marked the package as "No Fix Planned," extending the risk to forks and ports not managed directly by Igor Pavlov

Why This Bug Is Different from the Rest

The history of vulnerabilities in 7-Zip is not new: the dossier mentions ZDI-25-949 (CVE-2025-55188, directory traversal in ZIP) as historical risk-class context, but those are entirely distinct advisories with separate mechanisms and timelines. What makes CVE-2026-48095 exceptional is the convergence of three factors: a concrete and demonstrated memory-corruption primitive, an unexpectedly broad attack surface due to signature-based fallback, and a disclosure-to-fix time of three days that reflects the severity perceived by the maintainer.

The speed of the response does not compensate for the persistence of residual risk. Millions of endpoints run 7-Zip without automatic update mechanisms. Portable distributions, forensic imaging tools, utilities embedded in third-party software — all can carry vulnerable binaries without administrator awareness. The public PoC further lowers the threshold: no sophisticated reverse engineering is required to generate a file that triggers the crash.

The remaining uncertainty is precisely quantified in the dossier. No evidence emerges of active exploitation beyond PoC availability; CISA-ADP classifies the status as "poc" and automation as "no." It is not documented whether modern memory mitigations on official Windows builds (ASLR, CFG) make the exploit practically infeasible, and the dossier does not specify whether the 26.01 fix resolves the general shift UB logic or only the ClusterSizeLog≥28 with CompressionUnit==4 combination. For organizations, this means the patch is necessary but not sufficient to guarantee a complete understanding of risk: inventory and segmentation remain priorities.

FAQ

Should I worry if I never open .ntfs or .img files?

The concern is legitimate regardless of the extensions you avoid. 7-Zip's NTFS parser activates by signature, not by extension: a .zip, .7z, or extensionless file containing the NTFS signature at byte offset 3 will still reach the vulnerable code after the initial handler fallback.

Why does Amazon Linux give a lower CVSS?

The difference between 8.8 (GitHub/NVD) and 7.8 (Amazon Linux) lies exclusively in the Attack Vector parameter: Network versus Local. Both indicate High severity. The technical mechanism is identical; the delivery context of the malicious file changes the operational risk profile.

Is 7-Zip 26.01 sufficient or should I upgrade to 26.02?

Version 26.01, released April 27, 2026, contains the documented fix. Version 26.02, released June 25, 2026, is the current recommended version for new deployments. If you are on 26.01, the specific vulnerability of GHSL-2026-140 is resolved; upgrading to 26.02 is recommended but not urgent for this specific bug.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references