7-Zip up to 26.00 NTFS Archive NtfsHandler.cpp CInStream::GetCuSize out-of-bounds write

Summaryinfo

A vulnerability, which was classified as critical, was found in 7-Zip up to 26.00. Affected by this vulnerability is the function CInStream::GetCuSize of the file CPP/7zip/Archive/NtfsHandler.cpp of the component NTFS Archive Handler. Executing a manipulation can lead to out-of-bounds write. This vulnerability is registered as CVE-2026-48095. It is possible to launch the attack remotely. Furthermore, an exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in 7-Zip up to 26.00. It has been declared as critical. This vulnerability affects the function CInStream::GetCuSize of the file CPP/7zip/Archive/NtfsHandler.cpp of the component NTFS Archive Handler. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. The CWE definition for the vulnerability is CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

7-Zip is a file archiver with a high compression ratio. Versions 26.00 and prior contain a heap buffer overflow vulnerability caused by an under-allocation in the NTFS compressed stream buffer (GetCuSize shift UB), potentially allowing attackers to cause arbitrary code execution or application crashes. CInStream::GetCuSize() in the NTFS handler computes the compression-unit buffer size as (UInt32)1 << (BlockSizeLog + CompressionUnit), and a crafted image with ClusterSizeLog >= 28 and CompressionUnit == 4 drives the exponent to 32, which is undefined behavior and collapses on x86/x64 so _inBuf is allocated as 1 byte. ReadStream_FALSE then writes up to 256 MB of attacker-controlled data into that 1-byte buffer in 64 KB iterations, and because the CInStream object sits only 304 bytes after _inBuf, its vtable pointer is overwritten and the next dispatched call achieves a vtable hijack. On 32-bit builds the overflow is unconditionally reached; on 64-bit it requires the parallel 8 GB _outBuf allocation to succeed, otherwise failing closed to denial of service. The NTFS handler is enabled by default in stock 7z.dll and, via signature-based fallback matching "NTFS " at offset 3, will open a crafted image regardless of file extension during extraction or testing. Version 26.01 fixes the issue.

The advisory is shared for download at securitylab.github.com. This vulnerability was named CVE-2026-48095. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. Technical details and also a public exploit are known.

It is possible to download the exploit at securitylab.github.com. It is declared as proof-of-concept. The vulnerability scanner Nessus provides a plugin with the ID 321161 (Fedora 43 : 7zip (2026-f36864b408)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 26.01 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (321161). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• File Compression Software

Name

• 7-Zip

Version

• 26

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion