Loading story…
A newly published archive-parsing weakness, CVE-2026-0866 (dubbed “Zombie ZIP”), enables attackers to craft malformed ZIP files that can evade many antivirus and EDR scanners by manipulating ZIP header metadata. The technique sets the ZIP entry’s compression method to STORED while the embedded content remains DEFLATED, causing security tools that trust the header to skip decompression and scanning, resulting in false negatives. The malformed archives also typically fail to open or extract with standard ZIP utilities, which may surface errors such as CRC or unsupported method failures.
Technical analysis shows the inconsistency can be detected by inspecting ZIP record metadata (e.g., STORED entries where compressed and uncompressed sizes differ) and by using tooling that bypasses standard ZIP libraries to parse raw records and forcibly decompress data. The SANS ISC write-up demonstrates analysis workflows and updates to zipdump.py (including a forcedecompress capability) to recover the hidden payload (illustrated with an embedded EICAR test file), while reporting indicates real-world abuse would likely pair the malformed archive with a custom loader that ignores the falsified header and directly extracts/decompresses the concealed content for execution.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
A later report said that six days after public disclosure, 60 of 63 antivirus products still failed to detect the Zombie ZIP technique, indicating that vendor protections had not materially improved after the initial disclosure.
Didier Stevens' zipdump.py version 0.0.35 added a new "forcedecompress" option to attempt decompression regardless of the declared ZIP compression method, enabling analysis of malformed Zombie ZIP archives.
SANS Internet Storm Center published technical analysis showing how Zombie ZIP archives declare files as STORED while actually containing DEFLATED data, and demonstrated recovery of a hidden EICAR test file from a malformed sample.
Early public reports on the disclosure said the technique bypassed detection in the vast majority of tested antivirus products, with one account citing 50 of 51 engines fooled and another saying only Kingsoft detected the sample on VirusTotal.
CERT/CC published Vulnerability Note VU#976247 for CVE-2026-0866, documenting the malformed ZIP parsing issue, confirming Cisco as affected, listing many other vendors as unknown, and recommending validation of archive content rather than trusting ZIP metadata.
Security researcher Chris Aziz of Bombadil Systems developed a malformed ZIP archive technique later dubbed "Zombie ZIP," which falsifies ZIP header compression metadata so embedded malicious content can evade antivirus and EDR scanning while remaining recoverable with a custom loader.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
tomshardware.com
Open sourcescworld.com
Open sourcecsoonline.com
Open sourceisc.sans.edu
Open sourceisc.sans.edu
Open sourcecybersecuritynews.com
Open sourcecyberpress.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed **CVE-2026-48095**, a critical heap buffer overflow in 7-Zip affecting version `26.00` and earlier that can lead to application crashes, denial of service, or arbitrary code execution. The bug, reported by Jaroslav Lobačevski of GitHub Security Lab and tracked in advisory `GHSL-2026-140`, resides in the NTFS archive handler’s `CInStream::GetCuSize()` logic, where an under-allocation can shrink a buffer to 1 byte before a later operation writes up to 256 MB of attacker-controlled data into it. The resulting heap corruption can overwrite adjacent objects, including a stream object’s **vtable** pointer, creating a path to code execution. The vulnerability can be triggered simply by opening a specially crafted file because 7-Zip uses signature-based fallback detection and may route files disguised as `.7z`, `.zip`, or `.rar` into the vulnerable NTFS parser regardless of extension. Reports say both 32-bit and 64-bit builds are affected, with 64-bit systems that have sufficient memory more likely to reach reliable code execution, while lower-memory systems may instead crash. Public disclosure included technical details and a Python proof-of-concept generator, raising the risk of weaponization; the issue carries a **CVSS 3.1 score of 8.8**, and users are being urged to update 7-Zip and avoid opening untrusted archives.
Jun 29, 2026
A high-severity directory traversal flaw, **CVE-2026-17524**, has been disclosed in the `zip-lib` package before version `1.1.0`, allowing attackers to bypass extraction safeguards and write files outside the intended destination folder. The bug stems from cached path-validation results during archive extraction: `zip-lib` checks the `isOutsideTargetFolder` condition only when an initial directory symlink is created, enabling later archive entries to evade traversal protections. The issue is mapped to **CWE-22** and carries a **CVSS 3.1** score reflecting network-exploitable impact with high confidentiality risk. The vulnerability fits the long-running **Zip Slip** class of archive extraction bugs, in which crafted archive entries such as `../../` paths can overwrite arbitrary files and potentially lead to remote code execution across ZIP, TAR, JAR, CPIO, and other formats. Security research has shown this pattern affects thousands of projects across multiple ecosystems when extraction logic concatenates archive entry names without robust validation, and offensive testing tools such as **Archive Pwn** have made it easier to generate malicious archives using traversal paths, symlink abuse, Unicode tricks, and other bypass techniques. The `zip-lib` disclosure underscores that archive handling remains a persistent software supply chain and application security risk even years after the original Zip Slip wave of fixes.
Jul 29, 2026
A newly disclosed **7-Zip** vulnerability, tracked as `CVE-2026-14266`, allows remote code execution via a heap-based buffer overflow in the handling of crafted **XZ chunked data**. An attacker can trigger the flaw if a user opens a malicious archive or is lured to content that delivers a specially crafted XZ payload, causing code to run with the privileges of the current user. The issue is considered significant because 7-Zip is widely deployed and the attack path can be readily paired with phishing or malicious attachments. The bug was reported by Landon Peng of Lunbun LLC through coordinated disclosure, and the Zero Day Initiative published advisory **`ZDI-26-444`** after the fix became available. **7-Zip version 26.02**, released on June 25, 2026, contains the patch, and reporting said no public proof-of-concept or in-the-wild exploitation had been confirmed at publication. The flaw was assigned a **CVSS 7.0** score, reflecting the need for user interaction and a relatively complex exploit path, and users were urged to update and avoid opening untrusted compressed files.
Jul 24, 2026