Critical 7-Zip Heap Overflow in NTFS Parsing Enables Possible Code Execution

A critical vulnerability in 7-Zip tracked as CVE-2026-48095 and GHSL-2026-140 allows attackers to trigger a heap-based buffer overflow when a user opens a specially crafted archive containing an NTFS volume image. The flaw affects 7-Zip 26.00 and earlier and stems from incorrect buffer size calculations and insufficient boundary checks in the NTFS handler, where a computed buffer can shrink to 1 byte while later logic writes up to 256 MB of attacker-controlled data into it. Researchers said the bug can cause memory corruption, crashes, denial of service, and potentially arbitrary code execution, including through possible vtable pointer overwrite under favorable conditions.

The vulnerable NTFS handler is enabled by default in stock 7z.dll, and exploitation does not depend on a specific file extension because 7-Zip uses signature-based fallback matching for NTFS images. The issue was privately reported to the developers in April and fixed in 7-Zip 26.01, with vendor and researcher advisories later published alongside a Python proof-of-concept. With 7-Zip widely deployed on Windows and Linux systems and embedded in automated workflows and other software, defenders have little mitigation beyond upgrading to the patched release because no workaround has been identified.