7-Zip Fixed Multiple Parsing Flaws Including Critical NTFS Heap Overflow

GitHub Security Lab disclosed a set of vulnerabilities in 7-Zip affecting archive and filesystem-image parsing, with the most serious issue tracked as CVE-2026-48095 (GHSL-2026-140). The flaw is a heap buffer write overflow in NTFS compressed stream handling, specifically tied to edge-case parsing in GetCuSize(), and could potentially lead to arbitrary code execution when a crafted filesystem image is processed. A proof-of-concept described a malformed sparse NTFS disk image that abuses abnormal cluster sizing and compressed $DATA attributes to trigger the bug.

The broader set of advisories also covered additional defects in parsing formats including SquashFS, UEFI, UDF, WIM, 7z, and Ar, as well as a path traversal issue in a sample application. According to reporting on the disclosures, seven of eight advisories in the set received CVE identifiers, and the issues were addressed in 7-Zip 26.01. GitHub Security Lab also categorized the advisory pages in its AI-agent index as discoveries associated with AI-assisted research, though no specific agent was publicly identified.