New 7-Zip Vulnerabilities Let Attackers Execute Arbitrary Code and Compromise Systems

The security world was recently reminded that some of our most trusted, everyday open-source tools can harbor critical flaws. A major remote code execution (RCE) vulnerability, tracked as CVE-2026-48095, was disclosed in the ubiquitous 7-Zip archive utility.

Impactful up to version 26.00, this flaw allows attackers to compromise a system simply by convincing a user to open or extract a maliciously crafted archive file.

Let’s take a look under the hood at what went wrong in the source code, why it bypassed security controls, and how to protect your codebases and infrastructure.

---

🔍 The Anatomy of the Bug: NtfsHandler.cpp

The vulnerability lies within 7-Zip's internal NTFS archive handler (NtfsHandler.cpp). 7-Zip doesn't just read basic metadata; it parses raw disk images and file system structures to extract files.

The flaw boils down to a Heap Buffer Overflow triggered by a faulty integer arithmetic operation:

1. The 32-bit Shift Loophole: When calculating memory allocations for compressed internal structures, the code utilizes a 32-bit shift calculation to estimate size limits.
2. The Under-allocation: An attacker can carefully craft an archive with anomalous data structures that cause this calculation to wrap around or truncate.
3. The Hijack: As a result, 7-Zip allocates a heap buffer that is significantly smaller than the incoming payload. When the data is written into memory, it triggers an out-of-bounds write. This corrupts neighboring memory objects, leading to a "vtable hijack" that redirects application control flow to malicious code execution.

Why This Evades Standard Email Filters

What makes this particularly dangerous for end-users is that it is extension-agnostic.

7-Zip identifies formats by reading the magic bytes (internal file signatures) rather than trusting the file extension. An attacker can rename a highly malicious, exploited NTFS disk image to vacation_photos.zip or invoice.7z. When a user attempts to open it, 7-Zip automatically routes it to the vulnerable NTFS parsing engine.

---

🛠️ The DevOps & DevSecOps Reality Check

For developers and operations teams, bugs like this highlight a massive blind spot: Legacy third-party dependencies.

Many enterprise servers, automated CI/CD pipelines, and background microservices rely on command-line utilities like 7-Zip to extract uploaded files, process logs, or ingest data packages. If a service account running an unpatched version of 7-Zip extracts an untrusted user upload, your entire backend container or server could be compromised.

Prevention vs. Detection

When it comes to building your own file-handling logic, catching these structural mathematical errors early is critical. Running a repository scanner—like Debuggix, Semgrep, or SonarQube—as a casual part of your CI/CD pipeline helps catch integer overflows and path traversals in your own code before it gets compiled.

However, for third-party, pre-compiled desktop software like 7-Zip, repository scanners cannot intercept a compiled binary run by a user. For that, you need active patch management and software inventory monitoring.

---

🛡️ How to Protect Your Systems

If you or your team use 7-Zip, you need to remediate this immediately:

1. Update to 7-Zip v26.01+: The patch directly modifies the 32-bit memory allocation math in NtfsHandler.cpp to prevent truncation and buffer overflows.
2. Audit Production Environments: Check your deployment scripts, Dockerfiles, and build servers. Ensure any automated extraction scripts are executing the updated binary.
3. Sanitize User Uploads: If your application allows users to upload .zip or .7z files, ensure they are unpacked in isolated, sandboxed environments with low-privilege service accounts to limit the blast radius of potential execution.

Have you audited your servers for 7-Zip versions yet? Let’s discuss in the comments how your team manages unmanaged desktop utility dependencies in production!