7-Zip CVE-2026-48095: Critical RCE Vulnerability Patched

Overview: Heap Overflow in the NTFS Handler

On May 22, 2026, the GitHub Security Lab published advisory GHSL-2026-140 covering a critical vulnerability in 7-Zip. CVE-2026-48095 describes a heap-based buffer overflow in the NTFS archive handler of 7-Zip 26.00, triggered—according to the advisory—by faulty buffer sizing inside the CInStream::GetCuSize() function. The CVSS 3.1 score is 8.8 (High); the flaw permits remote code execution simply by opening a crafted file.

The vulnerability was discovered by Jaroslav Lobačevski (GHSL team member “@JarLob”). In their statement, the GitHub Security Lab explains that a specifically crafted NTFS image causes a shift operator with exponent 32 to execute in the code path. This triggers undefined behavior in C++ and allocates only 1 byte instead of several hundred megabytes. Into this 1-byte buffer, 7-Zip then writes up to 256 MB of attacker-controlled data—a textbook heap overflow with immediate impact on adjacent objects.

Technical Analysis: From Shift to vtable Hijack

According to GHSL-2026-140, the bug originates in this compression-unit size calculation: (UInt32)1 << (BlockSizeLog + CompressionUnit). The NTFS parser accepts cluster sizes up to 2^30 bytes. An attacker selects ClusterSizeLog ≥ 28 combined with CompressionUnit == 4 in the crafted NTFS image. The shift exponent thereby reaches 32, which—on a 32-bit data type—is undefined behavior under the C++ standard.

// CInStream::GetCuSize() in the NTFS handler implementation
UInt32 GetCuSize() {
    // BlockSizeLog is derived from cluster-size-log (>= 28 possible)
    // CompressionUnit is freely settable in the NTFS compressed attribute (up to 4)
    // With BlockSizeLog=28 and CompressionUnit=4 the exponent becomes 32.
    return (UInt32)1 << (BlockSizeLog + CompressionUnit);  // UB at >= 32
}

// Result: _inBuf is allocated as just 1 byte on x86/x64.
// Subsequently 7-Zip reads 256 MB of compressed cluster data into _inBuf.

The GitHub Security Lab describes the exploitation chain precisely: after only the first 304 bytes of overrun, the vtable pointer of an adjacently allocated CInStream object is overwritten. On the second Read() call, the program dispatches via the corrupted pointer—a textbook vtable hijack. The attacker thereby gains control of the instruction pointer.

Attack Surface: Any File Extension Is Dangerous

What makes CVE-2026-48095 particularly insidious is the MIME-magic behavior of 7-Zip. The software does not identify archives solely by file extension—it falls back to signature-based detection when the registered handler rejects the file. The NTFS handler responds to the signature "NTFS " at byte offset 3, regardless of whether the file has the extension .7z, .zip, .rar, or no extension at all.

For the attack precondition “user interaction required” (UI:R in the CVSS vector), a single double-click on a seemingly harmless archive file is enough. Combined with phishing campaigns, cloud-sharing links, and tampered download portals, the bar for a successful attack is low.

Impact: Who Is Affected?

With an estimated hundreds of millions of installations, 7-Zip is one of the most widely used archiving tools worldwide—on consumer and enterprise endpoints, bundled in software distributions, and embedded as a library in third-party products. The table below summarizes the directly affected configurations.

Recommended Actions

Remediating the flaw itself is trivial—7-Zip 26.01, released April 27, 2026, contains the fix. The challenge is completely locating every installation. The following four steps describe a pragmatic response:

# List local installations from the registry
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |
  Where-Object { $_.DisplayName -like "*7-Zip*" } |
  Select-Object DisplayName, DisplayVersion, InstallLocation

# Example output:
# DisplayName     DisplayVersion  InstallLocation
# -----------     --------------  ---------------
# 7-Zip 26.00     26.00           C:\Program Files\7-Zip\

# Remote query across multiple hosts (inventory)
$hosts = Get-Content .\inventory.txt
Invoke-Command -ComputerName $hosts -ScriptBlock {
  (Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*).
    Where({ $_.DisplayName -like "*7-Zip*" }) |
    Select-Object DisplayName, DisplayVersion
} | Export-Csv -NoTypeInformation -Path 7zip_audit.csv

Assessment: Lessons for Vulnerability Management

CVE-2026-48095 is exemplary of the current threat landscape around standard tools for three reasons: first, the enormous distribution of the affected software; second, the low barrier to entry (a double-click suffices); and third, the available proof-of-concept, which dramatically shortens the time to mass exploitation. Per the GHSL timeline, the flaw was reported on April 24, 2026, and remediated in 7-Zip 26.01 only three days later, on April 27. The vendor response was therefore exemplary in speed, but the subsequent disclosure on May 22 means defenders have been operating in an active window ever since.

For security leaders this means concretely: 7-Zip belongs in every inventory and every patch cycle—not only on primary workstations, but also on build servers, forensic workstations, mail gateways, and backup hosts. The question “Where is 7-Zip 26.00 running in our environment?” should be answerable within a few hours. Anyone unable to answer it today has a structural problem in asset and vulnerability management that CVE-2026-48095 merely makes visible.