A critical security vulnerability has been disclosed in 7-Zip, one of the most widely used open-source file archivers globally, that could allow attackers to execute arbitrary code on affected systems with minimal user interaction. Tracked as CVE-2026-48095 and GHSL-2026-140, the flaw resides in the application’s NTFS handler and stems from a dangerous memory management error that can be triggered simply by opening a specially crafted file. The vulnerability, which affects 7-Zip version 26.00 and likely earlier releases, has drawn urgent attention from security researchers who warn that exploitation requires little more than convincing a victim to open an archive or file that routes processing through the vulnerable NTFS parser. The discovery, made by researcher Jaroslav Lobačevski working with GitHub Security Lab, highlights how even trusted software with a long track record of reliability can harbor critical weaknesses in low-level parsing code.
A Buffer Calculation Gone Wrong
The vulnerability originates inside the NTFS handler implementation in 7-Zip, specifically within the CInStream::GetCuSize() function located in the NtfsHandler.cpp source file. This function is responsible for calculating buffer sizes when processing compressed NTFS streams, and it performs this calculation using a 32-bit bit-shift operation. The relevant code computes a buffer size using the expression (UInt32)1 << (BlockSizeLog + CompressionUnit)codecodecodecode, which under normal conditions determines the correct memory allocation for decompression. However, the flaw emerges when an attacker crafts a malicious NTFS image that sets specific metadata fields to extreme values. When ClusterSizeLog is set to 28 or higher and CompressionUnit equals 4, the exponent in the shift operation reaches 32, which triggers undefined behavior in the C++ language standard. On x86 systems, this causes the application to allocate only a single byte for what should be a much larger internal buffer. The severity escalates almost immediately, as 7-Zip then uses the ReadStream_FALSE function to process incoming data, which can attempt to write up to 256 MB of attacker-controlled content into that tiny 1-byte allocation, producing a textbook heap buffer overflow.
The Mechanics of Exploitation
Researchers analyzing the memory layout during exploitation discovered that the vulnerable buffer, identified as _inBuf, resides only 304 bytes away from a critical CInStream object on the heap. When the overflow occurs, attacker-controlled data rapidly overwrites memory beyond the intended buffer boundary. After approximately 304 bytes of overflow, the stream object’s virtual function table pointer, commonly referred to as a vtable pointer, becomes corrupted. On the next read operation, the application attempts to execute code through that overwritten pointer, a technique known as a vtable hijack attack. Because attackers have full control over the overflowing NTFS cluster data, they also control the corrupted pointer values, making reliable arbitrary code execution feasible. The exploit chain flows from a single malformed file through undefined behavior to a heap overflow and finally to code execution, all without requiring any special privileges or complex user actions beyond opening the file.
32-bit and 64-bit Systems Under Threat
The vulnerability affects both 32-bit and 64-bit versions of 7-Zip, though the exploitation characteristics differ between architectures. On 32-bit systems, the memory allocation undersizing occurs consistently, creating a highly reliable overflow condition that attackers can depend on for predictable exploitation. On 64-bit systems, the behavior is more nuanced. In some environments, internal buffer allocations may expand toward extremely large memory sizes, potentially reaching multiple gigabytes. Systems with sufficient memory may still proceed into the vulnerable execution path and become exploitable, while lower-memory systems are more likely to experience application crashes or denial-of-service conditions rather than direct code execution. The security impact remains critical regardless of architecture, and both user groups should treat this vulnerability with equal urgency.
Attack Surface Broader Than Expected
One of the most concerning aspects of this vulnerability is that exploitation does not depend on file extensions. Victims do not need to open files with .ntfs or .img extensions specifically. 7-Zip uses signature-based archive detection that attempts multiple handlers when processing files, meaning that an attacker can disguise a malicious NTFS image as a common archive type such as .7z, .zip, .rar, or even as a file without any extension. If extension-matching handlers fail, 7-Zip may automatically route processing toward the vulnerable NTFS parser, dramatically expanding the potential attack opportunities. Threat actors frequently distribute malicious files disguised as ordinary documents or archives through phishing emails, software downloads, forum attachments, and file-sharing services, and the broader detection logic increases the chances that unsuspecting users could trigger exploitation unintentionally. Security teams have long warned that file extension-based filtering is an unreliable defense, and this vulnerability provides a stark demonstration of that principle.
Discovery and Technical Validation
The vulnerability was discovered by Jaroslav Lobačevski, a security researcher known online as @JarLob, working in collaboration with GitHub Security Lab. Validation of the flaw was performed using Undefined Behavior Sanitizer instrumentation running on Linux x64 environments, where researchers observed runtime failures pointing directly toward the NtfsHandler.cpp source file, confirming that the undefined shift operation was the root cause. Further testing produced segmentation faults caused by corrupted virtual table pointers, validating the entire exploit chain from buffer overflow to potential code execution. Researchers also noted that the vulnerable logic has existed since NTFS compressed stream support was originally introduced in 7-Zip, meaning that earlier versions are likely affected as well. Users running older installations may remain exposed even if they have not upgraded recently, and the full scope of affected versions may not be known until a comprehensive audit is completed.
Immediate Recommendations for Users
Organizations and individual users should closely monitor updates from 7-Zip maintainers and install patched releases immediately once available. Until a fix is deployed, several protective measures can reduce risk. Avoid opening archive files from unknown sources, exercise caution with email attachments, and restrict execution of untrusted downloaded files. Use endpoint protection capable of detecting exploitation attempts, and keep archive utilities and system software fully updated. Security teams should consider monitoring for suspicious archive handling activity and unexpected crashes involving archive processing tools, as these may indicate exploitation attempts. The vulnerability reinforces the importance of defense-in-depth strategies, particularly for organizations that rely heavily on file exchange and archive processing.
Broader Implications for Software Security
This vulnerability demonstrates why memory safety remains one of cybersecurity’s most persistent challenges. Buffer overflows have existed for decades, yet they continue appearing inside modern software because low-level languages such as C and C++ offer performance advantages while demanding precise memory management. The truly dangerous aspect of this flaw is not merely the overflow itself but the reliability of the exploit path. Attackers are not simply causing application crashes; they can redirect execution flow through manipulated virtual table pointers, a technique that experienced exploit developers understand well and can weaponize effectively. The NTFS parser behavior also delivers a critical lesson about security assumptions. Modern applications frequently rely on content inspection rather than filenames alone, and attackers understand this deeply, actively abusing parser logic hidden behind convenience features. The vulnerability also raises questions about software supply-chain trust. 7-Zip remains one of the most widely used archive utilities globally because of its reputation for speed, compatibility, and open-source transparency, but open source alone does not eliminate security risk. Complex parsers handling compressed data, image formats, archives, and filesystem structures naturally become high-risk code areas due to their complexity, and archive software historically attracts attackers because compressed files bypass casual inspection and often act as delivery mechanisms for malicious payloads.
The Role of Undefined Behavior
The issue also highlights the importance of defensive coding practices. Undefined behavior inside C++ remains particularly dangerous because behavior differs across architectures and compiler implementations, making it difficult to predict and test comprehensively. Developers increasingly adopt memory-safe programming languages such as Rust precisely to reduce these categories of vulnerabilities. Cybersecurity teams should view this disclosure as another reminder that open file functionality represents a major attack surface, and applications processing external content should receive heightened security review. Fuzzing, sanitizer instrumentation, and aggressive memory validation remain essential components of secure software development, and organizations should invest in these practices for any software that parses untrusted data. The long existence of this vulnerable logic also demonstrates a cybersecurity reality often overlooked: some vulnerabilities remain hidden for years, and both attackers and defenders benefit from deeper code auditing practices because unnoticed flaws inside trusted software can become future exploitation opportunities.
Future Outlook
Archive-processing vulnerabilities will continue to be a major threat vector because compressed files remain one of the easiest delivery mechanisms for malware campaigns. Software developers will increasingly adopt memory-safe programming approaches to reduce buffer overflow risks that continue affecting C and C++ applications, though legacy codebases will require significant investment to harden. Future security research will likely focus more heavily on parser-level vulnerabilities hidden inside trusted utilities that users interact with every day, as these represent high-value targets with broad attack surfaces. As archive formats and filesystem parsing continue to grow more sophisticated, security engineering around parser components will become increasingly critical, and organizations should prioritize security reviews of any software that handles external content, particularly utilities that automatically process files based on content signatures rather than explicit user selection.
