Loading story…
GitHub Security Lab disclosed a set of vulnerabilities in 7-Zip affecting archive and filesystem-image parsing, with the most serious issue tracked as CVE-2026-48095 (GHSL-2026-140). The flaw is a heap buffer write overflow in NTFS compressed stream handling, specifically tied to edge-case parsing in GetCuSize(), and could potentially lead to arbitrary code execution when a crafted filesystem image is processed. A proof-of-concept described a malformed sparse NTFS disk image that abuses abnormal cluster sizing and compressed $DATA attributes to trigger the bug.
The broader set of advisories also covered additional defects in parsing formats including SquashFS, UEFI, UDF, WIM, 7z, and Ar, as well as a path traversal issue in a sample application. According to reporting on the disclosures, seven of eight advisories in the set received CVE identifiers, and the issues were addressed in 7-Zip 26.01. GitHub Security Lab also categorized the advisory pages in its AI-agent index as discoveries associated with AI-assisted research, though no specific agent was publicly identified.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Bugflation reported that GitHub Security Lab advisories covered multiple 7-Zip vulnerabilities across archive and filesystem-image parsing, with seven of eight reports assigned CVEs. It stated that all nine referenced GHSL reports were fixed in 7-Zip 26.01.
GitHub Security Lab published its AI Agents index, and the referenced 7-Zip advisory pages were classified there as AI-agent discoveries. The specific agent responsible was not identified in the cited coverage.
GitHub Security Lab published advisory GHSL-2026-140 describing a heap buffer write overflow in 7-Zip's NTFS parsing logic, tracked as CVE-2026-48095. The advisory included a proof-of-concept crafted sparse NTFS disk image intended to trigger the flaw.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
securitylab.github.com
Open sourcesecuritylab.github.com
Open sourcebugflation.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability in **7-Zip** tracked as `CVE-2026-48095` and `GHSL-2026-140` allows attackers to trigger a heap-based buffer overflow when a user opens a specially crafted archive containing an **NTFS volume image**. The flaw affects **7-Zip 26.00 and earlier** and stems from incorrect buffer size calculations and insufficient boundary checks in the NTFS handler, where a computed buffer can shrink to **1 byte** while later logic writes up to **256 MB** of attacker-controlled data into it. Researchers said the bug can cause memory corruption, crashes, denial of service, and potentially **arbitrary code execution**, including through possible vtable pointer overwrite under favorable conditions. The vulnerable NTFS handler is enabled by default in stock `7z.dll`, and exploitation does not depend on a specific file extension because 7-Zip uses signature-based fallback matching for NTFS images. The issue was privately reported to the developers in April and fixed in **7-Zip 26.01**, with vendor and researcher advisories later published alongside a Python proof-of-concept. With 7-Zip widely deployed on Windows and Linux systems and embedded in automated workflows and other software, defenders have little mitigation beyond upgrading to the patched release because no workaround has been identified.
Jun 29, 2026
GitHub Security Lab disclosed multiple vulnerabilities affecting **7-Zip 26.00 and earlier** and a separate path traversal flaw in the `7zDec` sample extractor from the **LZMA SDK**. The issues span several archive handlers, including **SquashFS, UEFI capsule and firmware parsing, UDF, WIM, and Ar**, and include out-of-bounds reads, uninitialized memory disclosure, integer overflow, and denial-of-service conditions. One SquashFS flaw affects only **32-bit builds**, while several of the bugs reportedly impact versions dating back to the **7-Zip 9.x** line. A fixed release, **7-Zip 26.01**, was published on SourceForge after private reporting by GitHub Security Lab researcher **Jaroslav Lobačevski**. The coordinated disclosure maps the findings to **GHSL-2026-115** through **GHSL-2026-122** and CVEs including `CVE-2026-48092`, `CVE-2026-48101`, `CVE-2026-48102`, `CVE-2026-48103`, `CVE-2026-48104`, `CVE-2026-48111`, and `CVE-2026-48112`; the SDK path traversal bug could allow **arbitrary file write** and potentially lead to **code execution** in affected sample-app implementations.
Jul 20, 2026
A newly disclosed **7-Zip** vulnerability, tracked as `CVE-2026-14266`, allows remote code execution via a heap-based buffer overflow in the handling of crafted **XZ chunked data**. An attacker can trigger the flaw if a user opens a malicious archive or is lured to content that delivers a specially crafted XZ payload, causing code to run with the privileges of the current user. The issue is considered significant because 7-Zip is widely deployed and the attack path can be readily paired with phishing or malicious attachments. The bug was reported by Landon Peng of Lunbun LLC through coordinated disclosure, and the Zero Day Initiative published advisory **`ZDI-26-444`** after the fix became available. **7-Zip version 26.02**, released on June 25, 2026, contains the patch, and reporting said no public proof-of-concept or in-the-wild exploitation had been confirmed at publication. The flaw was assigned a **CVSS 7.0** score, reflecting the need for user interaction and a relatively complex exploit path, and users were urged to update and avoid opening untrusted compressed files.
Jul 24, 2026