CVE-2026-48095: GHSL-2026-140_7-Zip: 7-Zip has a heap buffer overflow via NTFS compressed stream buffer under-allocation

Synopsis

Heap buffer overflow in 7-Zip versions 26.00 and prior, reachable over the network when a user opens or tests a crafted archive file. The NTFS compressed stream handler under-allocates a 1-byte buffer due to undefined behavior in a bit-shift operation, then writes up to 256 MB of attacker-controlled data into it, overwriting a vtable pointer. Successful exploitation achieves arbitrary code execution; on 64-bit systems where the secondary allocation fails, the result is an application crash. No fix version has been published upstream yet; HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must deliver a crafted archive to the victim over the network, since the vulnerable NTFS handler is triggered during extraction or testing of a remotely sourced file.

• AuthenticationNot required

  No authentication or account credentials are needed; any unauthenticated party who can supply a file to the target user can trigger the vulnerability.

• Victim interactionRequired

  The victim must open, extract, or test the crafted archive in 7-Zip, making this a social-engineering vector where the attacker persuades the user to interact with a malicious file.

• Attack complexityDetail

  Exploit reliability is high on 32-bit builds where the overflow is unconditionally reached; on 64-bit builds it requires a successful 8 GB secondary allocation, but failure there degrades to denial of service rather than blocking exploitation entirely.

Blast Radius

• On successful vtable hijack, the attacker executes arbitrary code in the context of the user running 7-Zip, gaining full access to that process's memory and permissions.
• The attacker can read files, environment variables, and secrets accessible to the current user account on the host.
• The attacker can write or modify files on disk, install persistent malware, or tamper with other application data.
• If the vtable hijack conditions are not met (64-bit builds with insufficient memory), the application crashes, disrupting any automated pipeline or user workflow that depends on archive processing.