CVE-2026-48095

7-Zip is commonly used to open and extract compressed files. This bug happens when 7-Zip opens a “trick” type of file format related to NTFS compression, and it can cause 7-Zip to crash—or, in the worst case, let an attacker run code while the file is being processed. Think of it like a decoder that can be confused by a specially crafted “barcode” so it misbehaves; updating removes the faulty behavior.

This matters if your business installs or runs 7-Zip to extract or test files you didn’t create yourself (for example: downloaded files, email attachments, or customer-provided archives). The risk is only relevant when the crafted content is reachable by 7-Zip during extraction/testing; there’s no effect if you never open such files. As far as public reporting in our sources goes, there’s no confirmed, dated record of attackers using this in the wild.

This is an AMBER issue: it’s high impact in principle (crash and potential code execution) and the fix is available, but public proof of real-world exploitation isn’t clearly confirmed in the sources provided. Treat it as a real patch target now, especially on systems that routinely open untrusted archives, and update to 26.01+ without waiting for a future incident.

Confirm whether you’re exposed

• Identify the 7-Zip version on each workstation/server that opens archives.
  • If the version is 26.00 or earlier, you are affected.
• Identify where “untrusted” files can enter your environment:
  • email attachments,
  • files downloaded from the internet,
  • customer-submitted archives,
  • shared folders where archives are opened automatically or by staff.

Upgrade to the fixed version

• Vendor fix: update 7-zip to 26.01 or higher.
• Ensure the update covers every place you run 7-Zip (including VDI images, RDS sessions, build/automation machines, and any machines used for file processing).

Temporary workaround (if you can’t patch immediately)

• Stop automatic extraction/testing of externally supplied archives on affected machines.
• Route untrusted archive handling through a controlled process (e.g., a dedicated, non-privileged file-processing machine) while you schedule the 26.01+ upgrade.

What to monitor after the update

• Confirm that your archive-handling workflows still succeed.
• Watch for “application crash” events from 7-Zip during file extraction jobs to ensure the update eliminated the failure mode you may have seen.

Timing note

• There is no CISA KEV listing for this issue based on the provided findings.

Severity and type

• CVE-2026-48095 is a heap buffer overflow (CWE-190) and a related buffer under-allocation issue (CWE-787) in 7-zip’s handling of NTFS compressed stream data.

Mechanism (how it’s triggered)

• Crafted NTFS-compressed content can trigger an under-allocation of the NTFS compressed stream input buffer during stream size computation, followed by writing more data than allocated while processing the stream.
• In the worst case, this can corrupt memory and lead to code execution; otherwise it can crash the application.

Exploitation status

• The provided sources do not list this in CISA KEV, and there is no clear dated press claim of real-world exploitation.
• No public exploit code is listed in the provided sources.

Fix

• 7-zip is fixed in 26.01; the vendor guidance states to update to 26.01 and above.

Prediction

• EPSS is reported as low (prediction only) and flat in trend; however, this does not override the availability of a vendor fix.

Maturity

• Based on the provided findings: no confirmed public exploit and no KEV entry; treat as plausible but not clearly weaponized in the open sources here.