A critical security vulnerability has been identified in 7-Zip, one of the world's most popular file compression and management tools, causing concern in the cybersecurity community. The issue affects version 26.00 of the application and allows attackers to achieve arbitrary code execution via specially crafted NTFS files.
The vulnerability, reported as CVE-2026-48095 , is linked to a critical heap buffer overflow in 7-Zip's NTFS archive handler. Security researchers warn that the flaw can be exploited to completely compromise a system simply by opening a malicious file, without requiring any further user interaction.
The most worrying aspect is that the attack is not limited to specific file types. A crafted file can be disguised as a .zip, .rar, .7z or even have no extension at all, easily bypassing users' suspicions.
See also: Universal Robots PolyScope 5: Critical vulnerability affects robots
How the NTFS handler vulnerability works
The technical root of the problem is found in the CInStream::GetCuSize() in the NtfsHandler.cpp. There, 7-Zip calculates the size of a buffer using a 32-bit shift operation, without adequate bounds checks.
When an attacker creates a specially modified NTFS image with specific ClusterSizeLog and CompressionUnit values, the calculation leads to undefined behavior in C++. On x86 systems, this results in the program only allocating a one-byte buffer, even though it then attempts to write a huge amount of data, which can reach up to 256 MB.
The consequence is catastrophic. Data overflows the buffer and overwrites critical memory structures, including the vtable pointer. In the next phase, the attacker gains code execution capability via vtable hijacking, a particularly dangerous exploitation technique.
Experts explain that the attacker can fully control the execution flow of the program, which practically means complete control of the victim's system.
Why the flaw is considered extremely dangerous
This vulnerability is considered critical not only because of its severity, but also because of the huge attack surface it creates. 7-Zip is used daily by millions of users, companies, and organizations to manage compressed files.
See also: KnowledgeDeliver LMS: Vulnerability allows RCE attacks
This means that a malicious email attachment, a file shared via cloud storage, or even a download from a forum can be an attack vector.
The most worrying thing is that 7-Zip's NTFS handler relies on signature detection, not just the file extension. If the program detects the "NTFS" signature at the appropriate byte offset, it will automatically trigger the vulnerable analysis mechanism, even if the file is in a deceptive format.
Simply put, a user may think they are opening an innocent ZIP file, while in fact they are activating a malicious NTFS parser.
The effects on 32-bit and 64-bit systems
The vulnerability affects both 32-bit and 64-bit versions of 7-Zip. However, systems with high available RAM are considered more vulnerable.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
In 64-bit environments with 16 GB of memory or more, large buffer allocation is achieved normally and the attack progresses fully to code execution. In contrast, on low-memory systems, allocation failure can limit the result to a denial-of-service (DoS).
However, researchers warn that even DoS attacks can be used in corporate environments to disrupt operations, destroy work, or create conditions for further compromise.
The discovery by GitHub Security Lab and the immediate need for information
The vulnerability was discovered by Jaroslav Lobačevski of GitHub Security Lab, who performed a responsible disclosure before the technical details were made public. The vulnerability was confirmed using the UBSan tool in Clang, which detected undefined behavior and sequential vtable pointer corruption.
See also: Wireshark 4.6.6 fixes ROHC Parser vulnerabilities
7-Zip has already released a patched version 26.01 , and experts urge users to upgrade immediately. At the same time, it is recommended to avoid opening untrusted compressed archives or disk images until the patch is installed.
The case highlights once again how dangerous even small vulnerabilities in everyday applications can become. A simple file decompression tool can turn into a full-blown compromise, especially when low-level memory corruption bugs are combined with modern exploitation techniques.
