๐จ๐ณcnBeta (Full RSS)โขStalecollected in 2h
Critical 7-Zip Vulnerability Puts Millions of Devices at Risk
๐กCritical security flaws in core utilities can compromise your entire development infrastructure.
โก 30-Second TL;DR
What Changed
Critical vulnerability allows remote code execution
Why It Matters
This vulnerability poses a significant supply chain risk for developers and automated systems that rely on 7-Zip for data processing, potentially allowing attackers to compromise build environments.
What To Do Next
Audit your CI/CD pipelines and server environments to ensure 7-Zip is updated to the latest patched version immediately.
Who should care:Developers & AI Engineers
Key Points
- โขCritical vulnerability allows remote code execution
- โขAffects millions of global terminal devices
- โขImmediate update to the latest version is required
๐ง Deep Insight
Web-grounded analysis with 12 cited sources.
๐ Enhanced Key Takeaways
- โขThe critical vulnerability, identified as CVE-2026-48095 (GHSL-2026-140), is a heap buffer write overflow located in 7-Zip's NTFS archive handler.
- โขThe flaw specifically stems from an under-allocation bug in the
CInStream::GetCuSize()function, where a crafted NTFS image can trigger undefined behavior in buffer size calculation, leading to a 1-byte buffer allocation that is then overflowed. - โขAffected versions include 7-Zip 26.00 and all earlier versions, with the fix being released in version 26.01 on April 27, 2026.
- โขThe attack surface is broadened because 7-Zip's signature-based fallback logic can route malicious NTFS images, even if they have common extensions like .7z, .zip, or .rar, into the vulnerable NTFS parser.
- โขSuccessful exploitation can lead to arbitrary code execution through vtable hijacking, where attacker-controlled data overwrites the stream object's vtable pointer, allowing a subsequent read operation to dispatch execution through the corrupted pointer.
๐ Competitor Analysisโธ Show
| Feature/Aspect | 7-Zip (v26.01) | WinRAR | PeaZip | WinZip |
|---|---|---|---|---|
| Licensing | Free and Open-Source (LGPL) | Commercial (proprietary RAR format) | Free and Open-Source (LGPL/GPL) | Commercial |
| Native Format | 7z (high compression) | RAR (proprietary, good compression) | 7z, ZIP, TAR, GZIP, BZIP2, etc. (supports many) | ZIP (de-facto standard) |
| Compression Ratio | Excellent (especially with LZMA/LZMA2) | Very Good (RAR5) | Good (supports 7z, other formats) | Moderate (ZIP) |
| Compression Speed | Slower for 7z (medium settings) | Faster for ZIP, good for RAR | Fastest for ZIP, good for 7z (fast) | Slowest for ZIP |
| Decompression Speed | Fast (7z medium) | Good (RAR) | Fastest (7z fast) | Significantly slower for ZIP |
| Encryption | Strong AES-256 | AES-256 (for RAR5) | AES-256 (for 7z, ZIP) | AES-256, Zip 2.0 Legacy |
| Update Mechanism | Manual user updates/package managers | Typically manual/user-initiated | Manual (can be managed by tools like PatchMyPC) | Automatic updates (for some versions/platforms) |
| Platform Support | Windows, macOS, Linux (command-line) | Windows, macOS, Linux, Android | Windows, macOS, Linux | Windows, macOS, Android, iOS |
๐ ๏ธ Technical Deep Dive
- The vulnerability, CVE-2026-48095 (GHSL-2026-140), is a heap buffer write overflow in the
CInStream::GetCuSize()function within 7-Zip's NTFS archive handler. - It occurs due to an under-allocation bug where a crafted NTFS image can manipulate a 32-bit shift expression used for buffer sizing. When the shift exponent reaches 32, it triggers undefined behavior in C++, resulting in the
_inBufbeing allocated as only 1 byte. - Subsequent read operations then attempt to write attacker-controlled data into this tiny 1-byte buffer, leading to a classic heap overflow condition.
- This overflow is exploitable because the adjacent heap layout allows the attacker to corrupt the stream object's vtable pointer. A second read operation then dispatches execution through this corrupted pointer, achieving arbitrary code execution.
- The attack is not restricted to files with
.ntfsor.imgextensions because 7-Zip employs a signature-based fallback mechanism. If the format matching the file extension fails to open, 7-Zip attempts to process the file with other handlers based on signature priority, potentially routing a disguised malicious file to the vulnerable NTFS parser. - In addition to CVE-2026-48095, 7-Zip 26.01 also addressed a cluster of other memory safety issues (GHSL-2026-115โGHSL-2026-122) across various archive formats, including SquashFS, UEFI capsules, UDF, and WIM, which involved out-of-bounds reads, integer overflows, and use of uninitialized heap memory.
- 7-Zip's core compression utilizes algorithms like LZMA, LZMA2, PPMd, and BZip2, with LZMA being the default for the 7z format.
- The 7z format supports strong AES-256 encryption, where the key is derived from a user-supplied passphrase using an SHA-256 hash function with a high number of iterations (key stretching) to resist brute-force attacks.
๐ฎ Future ImplicationsAI analysis grounded in cited sources
The widespread use of 7-Zip will intensify scrutiny on the security of other foundational open-source utilities.
Given 7-Zip's prevalence across various operating systems, command-line scripts, and CI/CD workflows, this critical vulnerability highlights the significant supply chain risk posed by widely adopted open-source components, prompting a broader re-evaluation of their security posture.
Organizations will face challenges in rapidly deploying patches due to 7-Zip's lack of an integrated auto-update mechanism.
Since 7-Zip relies on manual user updates or system package managers, many installations are likely to remain vulnerable for extended periods, increasing the window of opportunity for attackers and necessitating more proactive patch management strategies.
โณ Timeline
1999
7-Zip first released by Igor Pavlov.
2001
The 7z archive format, 7-Zip's native format, was introduced.
2008-12
The LZMA SDK 4.62, containing 7-Zip's core compression algorithm, was placed in the public domain.
2015
The 7z file format specification began to be distributed with 7-Zip's source code.
2026-04-24
The heap buffer overflow vulnerability (CVE-2026-48095) was privately reported to GitHub Security Lab by Jaroslav Lobaฤevski.
2026-04-27
7-Zip version 26.01 was released, containing fixes for CVE-2026-48095 and other memory safety issues.
2026-05-22
The public advisory for CVE-2026-48095 was published by GitHub Security Lab.
๐ Sources (12)
Factual claims are grounded in the sources below. Forward-looking analysis is AI-generated interpretation.
๐ฐ
Weekly AI Recap
Read this week's curated digest of top AI events โ
๐Related Updates
First atmosphere detected on habitable-zone exoplanet
cnBeta (Full RSS)โขJul 25
Samsung Secures $200B Broadcom AI Infrastructure Deal
cnBeta (Full RSS)โขJul 25
How AMD's 2006 ATI Acquisition Built Today's AI Empire
cnBeta (Full RSS)โขJul 25
Capcom reveals character design secrets for Project
cnBeta (Full RSS)โขJul 24
AI-curated news aggregator. All content rights belong to original publishers.
Original source: cnBeta (Full RSS) โ