Executive Summary
A critical vulnerability, CVE-2026-48095, has been identified in 7-Zip versions 26.00 and earlier. The flaw resides in the NTFS handler's processing of compressed streams, where a shift-based undefined behavior (UB) leads to a massive heap buffer overflow. This vulnerability is particularly dangerous because 7-Zip uses signature-based fallback detection; an attacker can mask a malicious NTFS image with any file extension (e.g., .pdf or .zip), and 7-Zip will still process it using the vulnerable NTFS handler if the initial extension-based parsing fails.
Technically, the exploit leverages an under-allocation of a decompression buffer (1 byte allocated vs. 256 MB written) to overwrite a stream object's vtable pointer. This leads to a classic vtable hijack and arbitrary code execution when the application attempts the next virtual function call. While the vulnerability exists on both 32-bit and 64-bit systems, high-memory 64-bit systems are more susceptible to reliable exploitation as they can accommodate the large auxiliary allocations required by the exploit pipeline.
Organizations are advised to upgrade to 7-Zip 26.01 immediately. Furthermore, defenders should be aware that 7z.dll is frequently bundled within third-party applications (backup tools, installers), meaning a system-wide update of the standalone 7-Zip application may not remediate all vulnerable instances on a host.