Loading vulnerability…
Heap Buffer Overflow in 7-Zip NTFS Handler
CVE-2026-48095 is a heap-based buffer overflow in 7-Zip’s NTFS archive handler affecting versions 26.00 and earlier. The flaw is in CInStream::GetCuSize() in NtfsHandler.cpp, which computes the NTFS compression-unit buffer size using a left-shift expression on a 32-bit value. A crafted NTFS image can force the shift exponent to 32 by combining a large cluster size with a compression unit value of 4, triggering undefined behavior and causing the input buffer to be under-allocated to 1 byte on x86 and x64 builds. Subsequent processing writes attacker-controlled compressed-stream data into that undersized heap buffer in repeated chunks, producing a large heap overwrite. Because a CInStream object can be allocated adjacent to the corrupted buffer, the overflow can overwrite its vtable pointer and enable control-flow hijacking on a later virtual call. The vulnerable NTFS handler is enabled by default and can be reached through signature-based fallback parsing of NTFS content regardless of file extension during archive testing or extraction.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause heap corruption leading to application crashes, denial of service, or arbitrary code execution in the security context of the 7-Zip process. The most severe outcome is vtable hijacking after overwrite of an adjacent CInStream object, allowing attacker-controlled control flow. On 32-bit builds the overflow condition is unconditionally reachable once the crafted NTFS image is processed. On 64-bit builds, reaching the full exploitation path depends on successful allocation of a large auxiliary output buffer; if that allocation fails, the result may be limited to a crash or failed processing rather than code execution.
If you can’t patch tonight, do this now.
If immediate patching is not possible, avoid opening, testing, or extracting untrusted archives or disk-image content with vulnerable 7-Zip versions. Reduce exposure by restricting use of 7-Zip on externally sourced files, especially in workflows that automatically inspect or unpack submitted content. Because the vulnerable NTFS parser can be invoked by signature-based detection rather than extension alone, extension-based blocking is insufficient; defensive controls should instead treat untrusted archive-like and disk-image-like content as potentially dangerous until patched versions are deployed.
Patch, then assume compromise.
Upgrade 7-Zip to version 26.01 or later, which fixes the NTFS compressed stream buffer under-allocation issue. Any product that bundles or redistributes vulnerable 7-Zip components should be updated to a release incorporating the fixed 7-Zip version. Asset owners should also identify embedded or portable copies of vulnerable 7-Zip libraries and replace them with patched builds.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
55 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.