Loading story…
GitHub Security Lab disclosed multiple vulnerabilities affecting 7-Zip 26.00 and earlier and a separate path traversal flaw in the 7zDec sample extractor from the LZMA SDK. The issues span several archive handlers, including SquashFS, UEFI capsule and firmware parsing, UDF, WIM, and Ar, and include out-of-bounds reads, uninitialized memory disclosure, integer overflow, and denial-of-service conditions. One SquashFS flaw affects only 32-bit builds, while several of the bugs reportedly impact versions dating back to the 7-Zip 9.x line.
A fixed release, 7-Zip 26.01, was published on SourceForge after private reporting by GitHub Security Lab researcher Jaroslav Lobačevski. The coordinated disclosure maps the findings to GHSL-2026-115 through GHSL-2026-122 and CVEs including CVE-2026-48092, CVE-2026-48101, CVE-2026-48102, CVE-2026-48103, CVE-2026-48104, CVE-2026-48111, and CVE-2026-48112; the SDK path traversal bug could allow arbitrary file write and potentially lead to code execution in affected sample-app implementations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
GitHub Security Lab publicly disclosed details of the coordinated vulnerability report for 7-Zip 26.00 and older versions and the 7zDec sample extractor. The advisory described affected components including SquashFS, UEFI capsule and firmware parsing, UDF, WIM, and Ar handlers, and documented impacts such as out-of-bounds reads, uninitialized memory disclosure, integer overflow, denial of service, and arbitrary file write.
A fixed release, 7-Zip v26.01, was published to address the coordinatedly disclosed vulnerabilities affecting several archive handlers and the LZMA SDK sample extractor. The flaws were associated with GHSL advisories and CVEs including CVE-2026-48092, CVE-2026-48101, CVE-2026-48102, CVE-2026-48103, CVE-2026-48104, CVE-2026-48111, and CVE-2026-48112.
GitHub Security Lab researcher Jaroslav Lobačevski privately delivered a report covering multiple vulnerabilities in 7-Zip 26.00 and older versions, along with a path traversal issue in the 7zDec sample extractor from the LZMA SDK. The issues included memory access violations, denial of service conditions, and a sample-app arbitrary file write risk.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GitHub Security Lab disclosed a set of vulnerabilities in **7-Zip** affecting archive and filesystem-image parsing, with the most serious issue tracked as **`CVE-2026-48095`** (`GHSL-2026-140`). The flaw is a **heap buffer write overflow** in NTFS compressed stream handling, specifically tied to edge-case parsing in `GetCuSize()`, and could potentially lead to arbitrary code execution when a crafted filesystem image is processed. A proof-of-concept described a malformed sparse NTFS disk image that abuses abnormal cluster sizing and compressed `$DATA` attributes to trigger the bug. The broader set of advisories also covered additional defects in parsing formats including **SquashFS, UEFI, UDF, WIM, 7z, and Ar**, as well as a **path traversal** issue in a sample application. According to reporting on the disclosures, **seven of eight** advisories in the set received CVE identifiers, and the issues were addressed in **7-Zip 26.01**. GitHub Security Lab also categorized the advisory pages in its AI-agent index as discoveries associated with AI-assisted research, though no specific agent was publicly identified.
Jul 20, 2026
A newly disclosed **7-Zip** vulnerability, tracked as `CVE-2026-14266`, allows remote code execution via a heap-based buffer overflow in the handling of crafted **XZ chunked data**. An attacker can trigger the flaw if a user opens a malicious archive or is lured to content that delivers a specially crafted XZ payload, causing code to run with the privileges of the current user. The issue is considered significant because 7-Zip is widely deployed and the attack path can be readily paired with phishing or malicious attachments. The bug was reported by Landon Peng of Lunbun LLC through coordinated disclosure, and the Zero Day Initiative published advisory **`ZDI-26-444`** after the fix became available. **7-Zip version 26.02**, released on June 25, 2026, contains the patch, and reporting said no public proof-of-concept or in-the-wild exploitation had been confirmed at publication. The flaw was assigned a **CVSS 7.0** score, reflecting the need for user interaction and a relatively complex exploit path, and users were urged to update and avoid opening untrusted compressed files.
Jul 24, 2026
Two high-severity vulnerabilities in the widely used open-source compression utility 7-Zip have been disclosed, allowing attackers to achieve remote code execution by leveraging specially crafted ZIP archives. The flaws, identified as CVE-2025-11001 and CVE-2025-11002, were reported by Trend Micro’s Zero Day Initiative and affect multiple builds of 7-Zip. These vulnerabilities arise from improper parsing of symbolic links within ZIP files, enabling a malicious archive to escape its intended extraction directory and write files to arbitrary locations on the victim’s system. If exploited, this directory traversal can be chained to execute arbitrary code with the privileges of the user running 7-Zip, potentially compromising the entire Windows environment. Both vulnerabilities have been assigned a CVSS base score of 7.0, reflecting their significant risk. Exploitation requires minimal user interaction; simply opening or extracting a malicious ZIP file is sufficient to trigger the attack. The vulnerabilities were quietly patched in 7-Zip version 25.00, released on July 5, 2025, but details were not publicly disclosed until October, leaving users unaware and exposed for several months if they had not updated. The lack of an automatic update mechanism in 7-Zip exacerbates the risk, as many users may not be running the latest, patched version. The vulnerabilities specifically allow attackers to overwrite or plant payloads in sensitive system paths, which can be used to hijack execution flow and escalate privileges. Security advisories emphasize the importance of updating to version 25.00 or later to mitigate these risks. The flaws highlight the ongoing challenges in securing widely deployed open-source tools, especially those lacking robust update mechanisms. Organizations relying on 7-Zip for file compression and extraction should prioritize patching and consider additional controls to limit the impact of potential exploitation. The vulnerabilities underscore the need for user awareness regarding the risks of opening files from untrusted sources. Security researchers warn that similar directory traversal and symlink handling issues may exist in other archiving tools, warranting broader scrutiny. The incident demonstrates the value of coordinated vulnerability disclosure and timely patch adoption. Enterprises are advised to audit their environments for outdated 7-Zip installations and deploy the latest version as a matter of urgency. The disclosure also serves as a reminder for software maintainers to implement secure default behaviors and consider automated update features to protect end users.
Jul 12, 2026