A new CVE (CVE-2026-48095) in 7-Zip means that malicious archive processing and user-directed attacks are a growing concern. According to GitHub Security Lab, CVE-2026-48095 is a heap buffer write overflow caused by a buffer size calculation error in the 7-Zip NTFS archive handler in versions prior to 26.01. Specifically, a user can trigger arbitrary code execution via the vulnerable NTFS archive handler by processing a malformed NTFS file. However, the problematic file does NOT require a specific NTFS file extension to be processed by the NTFS handler. It appears that 7-Zip's fallback signature-based logic will allow the NTFS handler to be called even when a crafted file uses a non-NTFS file extension such as .7z, .rar, or .zip. This opens up additional avenues of potential attack for phishing-type deliveries as well as social engineering attacks.
For defenders, the key information about CVE-2026-48095 is the impacted 7-Zip build number, how the vulnerable handler is triggered, and the fact that public exploit tools have been created. As explained by GitHub Security Lab, Jaroslav Lobačevski privately disclosed CVE-2026-48095 to them on April 24, 2026. Subsequent public disclosures indicated that a functional Python tool had been posted alongside their advisory.
CVE-2026-48095 Analysis
On a more technical level, CVE-2026-48095 results from an under-allocation bug in the NTFS compressed stream buffer inside CInStream::GetCuSize(). GitHub Security Lab describes how an attacker can craft an NTFS image causing the shift expression used to calculate buffer sizes to result in an exponent of 32, which causes undefined behavior in C++, leaving _inBuf to be allocated as only one byte. Therefore, when the next read operation occurs, attacker-controlled data will be written into that small buffer, resulting in a classic heap overflow scenario.
The overflow becomes exploitable because the adjacent memory layout allows the attacker to replace the stream object's vtable pointer. Public analysis indicates that the first read can overwrite the vtable after only a few hundred bytes of writing, and subsequently the second read will call through the replaced vtable pointer, enabling execution of attacker-supplied code in the best case, and denial of service on low-memory systems.
GitHub Security Lab and other public sources indicate that the vulnerability can be exploited to execute arbitrary code. Additionally, these sources note that lower-memory systems may experience denial-of-service conditions instead. The publicly available CVE-2026-48095 proof of concept increases the risk profile of this issue. Reports indicate that the researcher has made gen_ntfs_sparse.py, a Python tool that creates an NTFS sparse image exploiting CVE-2026-48095. In practice, CVE-2026-48095 payloads are specifically crafted archive images rather than dropped executables, which fits typical social-engineering schemes where a user is tricked into opening an innocuous-looking compressed file.
Operational impact of CVE-2026-48095
CVE-2026-48095 impacts systems on which users are opening untrusted archive files using vulnerable versions of 7-Zip. The coordinated advisory explicitly tested version 26.00, but subsequent reports indicate that the flawed sizing logic predated that release, suggesting it has likely existed across more than just the tested version.
CVE-2026-48095 mitigations
The primary mitigation for CVE-2026-48095 is to upgrade immediately to 7-Zip 26.01 or newer. The GitHub Security Lab disclosure timeline indicates that CVE-2026-48095 was patched and included in 7-Zip 26.01 on April 27, 2026. 7-Zip's official changelog confirms that version 26.01 was released on that date with bug fixes.
Practically, detecting CVE-2026-48095 involves identifying all endpoints currently running 7-Zip build 26.00 and assessing environments in which users commonly unpack external compressed files. Systems used for email triage and download activities, reverse engineering and malware analysis, and administrative operations involving compressed files should be prioritised for detection. Since CVE-2026-48095 provides a file-driven pathway for exploitation, asset and version identification are the most efficient initial steps rather than network reconnaissance.
Vendor-provided IOCs were not identified in the available documentation for CVE-2026-48095. Teams attempting to detect CVE-2026-48095 should therefore look for suspicious archive-opening events, crashes related to 7-Zip processing NTFS-like content, and user workflows where disguised archive extensions could potentially invoke the vulnerable handler. Without additional logging and telemetry options, patching and user caution remain the most viable means of defence.
