Multiple memory safety bugs in 7‑Zip 26.00 allow remote attackers to leak sensitive data and, in at least one case, execute arbitrary code when a victim opens a crafted archive file.
GitHub Security Lab has disclosed a critical heap buffer overflow in 7‑Zip’s NTFS handler (GHSL‑2026‑140, CVE‑2026‑48095), alongside a cluster of additional memory access violations tracked as GHSL‑2026‑115–GHSL‑2026‑122.
All issues affect 7‑Zip 26.00 and earlier; fixes were shipped in version 26.01 on April 27, 2026.
7‑Zip is widely used on Windows and other platforms, meaning these flaws have a broad impact across consumer and enterprise endpoints.
The most severe bug is a heap buffer overflow in the NTFS archive handler, caused by undefined behavior in a 32‑bit shift used to compute the NTFS compression unit buffer size.
By crafting a malicious NTFS image with large cluster sizes and a specific compression unit, an attacker can force 7‑Zip to allocate a 1‑byte input buffer and then write up to 256 MB of attacker‑controlled data into it during decompression.
Because the overflow overwrites a nearby stream object and its vtable pointer, a second read call can be redirected to attacker‑controlled code, enabling arbitrary code execution in the context of the 7‑Zip process.
The NTFS handler is auto‑detected by signature, so the attack is not limited to .ntfs or .img files; any file extension that fails its primary handler but contains an NTFS signature can be routed to the vulnerable code path.
In separate advisories, GitHub Security Lab describes a set of memory safety issues across multiple archive formats handled by 7‑Zip, including SquashFS, UEFI capsules, UDF, WIM, and others.
These flaws include out‑of‑bounds reads, integer overflows, and use of uninitialized heap memory, which can leak process memory or, in some cases, be used as building blocks in more complex exploit chains.
For example, a 32‑bit integer overflow in the SquashFS handler allows a crafted fragment offset to bypass bounds checks and read data from before a heap buffer, exposing heap contents in the extracted file.
Similarly, the UEFI capsule (.scap) parser can leak up to 1 GiB of uninitialized heap memory into extracted content if a capsule image is truncated, potentially disclosing data from previously processed archives or even secrets such as passwords.
Affected Versions and Patches
According to the project website and GitHub advisories, all 7‑Zip versions up to and including 26.00 are affected by these issues, with some bugs present since the 9.x series.
The maintainer released 7‑Zip 26.01 on April 27, 2026, which includes fixes for GHSL‑2026‑140 and GHSL‑2026‑115–GHSL‑2026‑122.
Security researchers and vendors are tracking the NTFS overflow as CVE‑2026‑48095, with a CVSS v3.1 score of 8.8 (High) due to its potential for remote code execution with minimal user interaction.
Several of the information‑disclosure issues in formats like SquashFS and UEFI are rated Medium severity, reflecting their ability to leak sensitive heap content but not directly modify it.
In a realistic attack, a threat actor could deliver a weaponized archive, such as a disk image masquerading as a common compressed file type, and rely on 7‑Zip’s format probing to hand the file off to the vulnerable handler.
On a system running an affected 7‑Zip version, simply opening or extracting the malicious file would be enough to trigger the overflow or data leak, with no further user interaction required.
Given 7‑Zip’s prevalence in enterprise environments, these vulnerabilities are attractive for phishing campaigns, initial access operations, or privilege‑escalation chains when combined with other local weaknesses.
Public proof‑of‑concept generators already exist for several of the bugs, lowering the barrier for exploitation by less sophisticated attackers.
Administrators and end users should upgrade to 7‑Zip version 26.01 or later as soon as possible, using the official downloads from 7‑Zip.org or trusted software distribution channels.
Where rapid patching is not possible, organizations should consider temporarily limiting the use of 7‑Zip on high‑value systems and enforcing additional controls for handling untrusted archive formats, especially NTFS images, SquashFS, UEFI capsules, UDF ISOs, and WIM files.
Security teams should also update vulnerability management tools to detect outdated 7‑Zip installations and monitor for suspicious archive file activity that could indicate exploitation attempts.
Because some issues enable in‑band data exfiltration via extracted content, defenders should treat unexpected or malformed output files as potential indicators of compromise and investigate accordingly.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…