Critical 7-Zip NTFS Handler Flaw Enables Code Execution via Crafted Archives

Researchers disclosed CVE-2026-48095, a critical heap buffer overflow in 7-Zip affecting version 26.00 and earlier that can lead to application crashes, denial of service, or arbitrary code execution. The bug, reported by Jaroslav Lobačevski of GitHub Security Lab and tracked in advisory GHSL-2026-140, resides in the NTFS archive handler’s CInStream::GetCuSize() logic, where an under-allocation can shrink a buffer to 1 byte before a later operation writes up to 256 MB of attacker-controlled data into it. The resulting heap corruption can overwrite adjacent objects, including a stream object’s vtable pointer, creating a path to code execution.

The vulnerability can be triggered simply by opening a specially crafted file because 7-Zip uses signature-based fallback detection and may route files disguised as .7z, .zip, or .rar into the vulnerable NTFS parser regardless of extension. Reports say both 32-bit and 64-bit builds are affected, with 64-bit systems that have sufficient memory more likely to reach reliable code execution, while lower-memory systems may instead crash. Public disclosure included technical details and a Python proof-of-concept generator, raising the risk of weaponization; the issue carries a CVSS 3.1 score of 8.8, and users are being urged to update 7-Zip and avoid opening untrusted archives.