7-Zip NTFS Handler Heap Overflow CVE-2026-48095 — vtable Hijack via Crafted Archive (GHSL-2026-140)

7-Zip NTFS Handler Heap Overflow CVE-2026-48095 (TL-2026-0586), also tracked as GHSL-2026-140, is a high-severity software vulnerability scored CVSS 8.8, first published 2026-05-26. It has no confirmed attribution, affects Igor Pavlov 7-Zip, references 1 CVE (CVE-2026-48095), maps to 19 MITRE ATT&CK techniques (T1027.009, T1036.005, T1036.007), and is covered by 9 detection rules and 21 indicators of compromise.

Key facts for TL-2026-0586

Threat ID
TL-2026-0586
Also known as
GHSL-2026-140, 7-Zip NTFS Handler vtable Hijack
Severity
HIGH
CVSS
8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Status
PATCHED
Category
VULNERABILITY
First published
2026-05-26
Last reviewed
2026-05-26
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
technology, government, financial, healthcare, manufacturing, education, energy, defense, media, professional-services
Target regions
Global
Detection rules
9
Indicators of compromise
21

A heap buffer overflow in 7-Zip versions through 26.00 (CVE-2026-48095, GHSL-2026-140) lets attackers achieve arbitrary code execution by tricking a user into opening a crafted NTFS image. A shift-overflow defect in CInStream::GetCuSize() (NtfsHandler.cpp:687) allocates a 1-byte _inBuf that is then overwritten with up to 256 MB of attacker-controlled data, corrupting the adjacent CInStream object's vtable and yielding a classic vtable hijack on both 32-bit and 64-bit builds. The NTFS handler's signature-based fallback means the bug is reachable regardless of file extension (.7z, .zip, .rar, or none).

How 7-Zip NTFS Handler Heap Overflow CVE-2026-48095 works

CVE-2026-48095 (GitHub Security Lab advisory GHSL-2026-140) is a heap buffer overflow in the NTFS handler of 7-Zip versions through 26.00 that leads to arbitrary code execution via vtable hijacking. The flaw was responsibly disclosed by Jaroslav Lobačevski (@JarLob) of the GitHub Security Lab and confirmed using UBSan (UndefinedBehaviorSanitizer) under Clang on Linux x64.

Root cause: The function CInStream::GetCuSize() in CPP/7zip/Archive/Ntfs/NtfsHandler.cpp (line 687) computes the NTFS compression-unit buffer size with the expression (UInt32)1 << (BlockSizeLog + CompressionUnit). When an attacker-crafted NTFS image sets ClusterSizeLog >= 28 — a value explicitly accepted by 7-Zip's parser — and the compressed-data attribute carries CompressionUnit == 4, the shift exponent reaches 32. A 32-bit shift of a 32-bit value is undefined behavior in C++. On x86/x64 hardware, the CPU silently masks the shift count to 5 bits, so the result is 1 instead of 0, and the buffer is allocated as a single byte via _inBuf.Alloc(1).

Exploit primitive: The undersized 1-byte _inBuf is then passed to a ReadStream_FALSE call that copies up to 256 MB of attacker-controlled cluster data into it. Because the adjacent CInStream object is placed only 304 bytes after _inBuf on the heap, the first 64 KB read iteration overwrites the object's vtable pointer with attacker-supplied bytes. The second iteration immediately dispatches a virtual call through the now-corrupted vtable, producing a clean vtable hijack with full attacker control over the indirect call target. On 64-bit systems with at least 16 GB RAM the preceding _outBuf.Alloc(8 GB) call succeeds and execution proceeds straight to the overflow; on lower-memory systems the allocation fails and the bug degrades to a denial-of-service.

Reachability and attack surface: 7-Zip's NTFS handler is registered with a signature-based fallback that matches the literal byte sequence 'NTFS ' at offset 3 of the archive. As a result, the vulnerable handler is invoked regardless of file extension — a malicious NTFS image disguised as .7z, .zip, .rar, .iso, or with no extension at all will be parsed through the buggy path once the extension-matched handler rejects the file. The only required user interaction is opening the crafted file in 7-Zip (Explorer shell, 7zFM.exe GUI, or 7z.exe command-line all reach the same code path). This makes the bug suitable for phishing payloads, supply-chain artifacts, and watering-hole archive drops.

Classification: CWE-787 (Out-of-Bounds Write) and CWE-190 (Integer Overflow or Wraparound). CVSS 3.1 base score 8.8 (High), vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The flawed GetCuSize() computation has been present since NTFS compressed-stream support was first introduced in 7-Zip, so every 7-Zip release with NTFS support up to and including 26.00 is vulnerable. UBSan flagged the root-cause shift UB at NtfsHandler.cpp:687, followed by a cascading invalid vtable dereference resulting in SIGSEGV in the proof-of-concept crash.

No in-the-wild exploitation has been reported at disclosure time, but the public advisory contains sufficient technical detail (root-cause location, trigger conditions, heap layout, vtable corruption mechanic) for skilled adversaries to weaponize. Users should update 7-Zip to a patched build immediately and treat untrusted archive files of any extension as potentially malicious until the fix is deployed.

MITRE ATT&CK techniques used in TL-2026-0586

Defense Evasion

T1027.009 Obfuscated Files or Information: Embedded Payloads; T1036.005 Match Legitimate Resource Name or Location; T1036.007 Masquerading: Double File Extension; T1055 Process Injection; T1574 Hijack Execution Flow

Execution

T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution; T1204.002 User Execution: Malicious File

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071.001 Application Layer Protocol: Web Protocols

Discovery

T1082 System Information Discovery; T1083 File and Directory Discovery

Initial Access

T1189 Drive-by Compromise; T1195.002 Supply Chain Compromise: Compromise Software Supply Chain; T1566 Phishing; T1566.001 Phishing: Spearphishing Attachment; T1566.002 Phishing: Spearphishing Link

Impact

T1499 Endpoint Denial of Service

Persistence

T1547 Boot or Logon Autostart Execution

Affected products and versions in 7-Zip NTFS Handler Heap Overflow CVE-2026-48095

  • Igor Pavlov — 7-Zip
    Vulnerable versions: all versions through 26.00 with NTFS compressed-stream support
    Fixed in: post-26.00 release containing the GHSL-2026-140 fix
  • Igor Pavlov — 7-Zip libraries (7z.dll, 7za.dll, 7zxa.dll)
    Vulnerable versions: all builds up to and including 26.00
    Fixed in: post-26.00 patched builds
  • Multiple — Downstream software bundling 7-Zip components (forensic suites, installers, archive integrations)
    Vulnerable versions: any product redistributing vulnerable 7z.dll/7za.dll/7zxa.dll
    Fixed in: products rebuilt against patched 7-Zip

Remediation for 7-Zip NTFS Handler Heap Overflow CVE-2026-48095

Patches

  • Upgrade 7-Zip to the post-26.00 release containing the GHSL-2026-140 fix from https://www.7-zip.org/
  • Recompile and redistribute downstream products that bundle vulnerable 7z.dll/7za.dll/7zxa.dll once a patched upstream is available

Immediate actions

  • Update 7-Zip to the patched version above 26.00 on every endpoint, build server, and forensic workstation
  • Block inbound email attachments and web downloads of archive types (.7z, .zip, .rar, .iso, .img) at the secure email gateway and web proxy pending patch deployment
  • Disable Windows Explorer shell integration for 7-Zip on high-value hosts until updated to deny implicit double-click exploitation
  • Warn users not to open archive files from untrusted sources regardless of extension — NTFS-image disguise defeats extension allow-listing

Workarounds

  • Until patched, default to a non-7-Zip archive utility for opening untrusted files
  • Use Windows Defender Application Control (WDAC) to block 7zFM.exe from spawning child processes on workstations
  • Configure attack-surface-reduction (ASR) rule 'Block all Office applications from creating child processes' equivalent for 7zFM.exe via EDR
  • Restrict 7-Zip execution to within a sandbox (Windows Sandbox, Sandboxie, or container) when triaging suspicious archives

Longer-term hardening

  • Deploy EDR with behavioral detection for archive-utility processes spawning child processes or unusual memory allocation patterns
  • Enforce application allow-listing so unauthorized 7-Zip builds cannot run on managed endpoints
  • Run UBSan/ASan-instrumented builds of archive utilities as part of CI for in-house tooling that bundles 7-Zip libraries (7z.dll, 7za.dll, 7zxa.dll)
  • Inventory third-party software that bundles 7-Zip components and track patch propagation downstream

CVEs associated with 7-Zip NTFS Handler Heap Overflow CVE-2026-48095

CVE-2026-48095

Weaknesses (CWE) in 7-Zip NTFS Handler Heap Overflow CVE-2026-48095

CWE-787, CWE-190

Timeline of 7-Zip NTFS Handler Heap Overflow CVE-2026-48095

  • Jaroslav Lobačevski (@JarLob) of the GitHub Security Lab identifies the shift undefined-behavior root cause in CInStream::GetCuSize() (NtfsHandler.cpp:687) during fuzz-driven analysis of 7-Zip 26.00 with UBSan under Clang on Linux x64.
  • UBSan confirms the shift UB at NtfsHandler.cpp:687 and the cascading invalid vtable dereference resulting in SIGSEGV — establishes vtable-hijack primitive on 32-bit and 64-bit builds.
  • GitHub Security Lab notifies 7-Zip maintainer Igor Pavlov under coordinated-disclosure timeline; advisory tracked internally as GHSL-2026-140.
  • CVE-2026-48095 reserved and assigned to the 7-Zip NTFS handler heap overflow.
  • Threadlinqs Intelligence opens TL-2026-0586 to track the 7-Zip NTFS handler vtable-hijack RCE, mapping MITRE techniques, IOCs, and detections for SOC consumers.
  • Public disclosure: GitHub Security Lab publishes GHSL-2026-140 advisory and Cyber Security News covers the vulnerability with technical detail including exploit chain, CVSS 8.8 scoring, and signature-based fallback attack surface.
  • As of 2026-05-29, CVE-2026-48095 is fixed in 7-Zip 26.01 (GitHub Security Lab advisory GHSL-2026-140), with no in-the-wild exploitation reported and no CISA KEV listing. A public PoC generator (gen_ntfs_sparse.py) and widespread downstream 7z.dll bundling keep unpatched copies a residual concern, but the live threat is neutralized by the shipped patch.

Sources cited for 7-Zip NTFS Handler Heap Overflow CVE-2026-48095

Threats related to 7-Zip NTFS Handler Heap Overflow CVE-2026-48095

Detection coverage for TL-2026-0586

As of 2026-05-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0586 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats