CVE-2026-48095 GHSL-2026-140_7-Zip: 7-Zip has a heap buffer overflow via NTFS compressed stream buffer under-allocation
A heap buffer overflow in 7-Zip's NTFS handler allows attackers to execute arbitrary code or crash the application via a crafted image file.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-48095?
CVE-2026-48095 is a high-severity memory corruption vulnerability in mcmilk 7-Zip, published on 5 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
7-Zip is a file archiver with a high compression ratio. Versions 26.00 and prior contain a heap buffer overflow vulnerability caused by an under-allocation in the NTFS compressed stream buffer (GetCuSize shift UB), potentially allowing attackers to cause arbitrary code execution or application crashes. CInStream::GetCuSize() in the NTFS handler computes the compression-unit buffer size as (UInt32)1 << (BlockSizeLog + CompressionUnit), and a crafted image with ClusterSizeLog >= 28 and CompressionUnit == 4 drives the exponent to 32, which is undefined behavior and collapses on x86/x64 so _inBuf is allocated as 1 byte. ReadStream_FALSE then writes up to 256 MB of attacker-controlled data into that 1-byte buffer in 64 KB iterations, and because the CInStream object sits only 304 bytes after _inBuf, its vtable pointer is overwritten and the next dispatched call achieves a vtable hijack. On 32-bit builds the overflow is unconditionally reached; on 64-bit it requires the parallel 8 GB _outBuf allocation to succeed, otherwise failing closed to denial of service. The NTFS handler is enabled by default in stock 7z.dll and, via signature-based fallback matching "NTFS " at offset 3, will open a crafted image regardless of file extension during extraction or testing. Version 26.01 fixes the issue.
Which versions are affected by CVE-2026-48095?
It affects 1 product.
Linux distribution packages (1)
7zip openSUSE:Tumbleweed | All versions | 26.01-1.1 |
Products include 7-Zip 7-Zip.
How do I fix CVE-2026-48095?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-48095 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-48095 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in mcmilk 7-Zip
Sources
Also known as ALPINE-CVE-2026-48095, DEBIAN-CVE-2026-48095, ECHO-4f58-a58d-8e80, MGASA-2026-0238, MINI-38ph-r5x6-2gv7, UBUNTU-CVE-2026-48095 and 1 more.