Reported by 1 outlet
Critical 7-Zip Heap Overflow (CVE-2026-48095) — NTFS Handler RCE via Crafted Archive, Fixed in 26.01
Why this score
- Breadth
- 0.50 / 2.0 · 1 source
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 3.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Critical 7-Zip Heap Overflow (CVE-2026-48095) — NTFS Handler RCE via Crafted Archive, Fixed in 26.01
gbhackers.com · 141d ago · May 26th, 2026
GitHub Security Lab disclosed a critical heap buffer overflow in 7-Zip's NTFS archive handler (GHSL-2026-140 / CVE-2026-48095, CVSS 8.8) affecting all versions up to 26.00. The vulnerability stems from undefined behavior in a 32-bit shift computing the NTFS compression unit buffer size, allowing an attacker to force a 1-byte input buffer allocation and then write up to 256 MB of attacker-controlled data during decompression — overwriting a nearby stream object's vtable pointer for arbitrary code execution. The NTFS handler is auto-detected by signature, so any file extension with an NTFS signature can be routed to the vulnerable code path.
Eight additional memory safety issues (GHSL-2026-115–122) affect SquashFS (integer overflow, heap leak), UEFI capsules (up to 1 GiB heap leak), UDF, and WIM parsers. Public PoC generators already exist for several bugs. Fixed in 7-Zip 26.01 (April 27, 2026). Given 7-Zip's widespread deployment, administrators should prioritize patching — a crafted archive opened by any user on an affected system is sufficient for compromise.