CVE-2026-48095
Published: June 5th, 2026
7-Zip is a file archiver with a high compression ratio. Versions 26.00 and prior contain a heap buffer overflow vulnerability caused by an under-allocation in the NTFS compressed stream buffer (GetCuSize shift UB), potentially allowing attackers to cause arbitrary code execution or application crashes. CInStream::GetCuSize() in the NTFS handler computes the compression-unit buffer size as (UInt32)1 << (BlockSizeLog + CompressionUnit), and a crafted image with ClusterSizeLog >= 28 and CompressionUnit == 4 drives the exponent to 32, which is undefined behavior and collapses on x86/x64 so _inBuf is allocated as 1 byte. ReadStream_FALSE then writes up to 256 MB of attacker-controlled data into that 1-byte buffer in 64 KB iterations, and because the CInStream object sits only 304 bytes after _inBuf, its vtable pointer is overwritten and the next dispatched call achieves a vtable hijack. On 32-bit builds the overflow is unconditionally reached; on 64-bit it requires the parallel 8 GB _outBuf allocation to succeed, otherwise failing closed to denial of service. The NTFS handler is enabled by default in stock 7z.dll and, via signature-based fallback matching "NTFS " at offset 3, will open a crafted image regardless of file extension during extraction or testing. Version 26.01 fixes the issue.
HIGH
CVSS v3: 8.8
CVSS v3: 8.8
Status
| DocFilters Release | Package | State | Justification | Comment |
|---|---|---|---|---|
| 26.3 | 7-zip (23.01) | Not Affected | Code Not Present | The vulnerability exists in the NTFS handler (CInStream::GetCuSize in NtfsHandler.cpp), which is part of the full 7-Zip application and is not present in the LZMA SDK. Document Filters consumes LZMA SDK 23.01, whose Archive directory ships only the 7z, LZMA, XZ, and Split handlers; NtfsHandler.cpp does not exist in the SDK distribution and is not included in the Document Filters build source list (external/CMakeLists.txt). The vulnerable GetCuSize function is therefore never compiled or reachable. |
| 26.2 | 7-zip (23.01) | Not Affected | Code Not Present | The vulnerability exists in the NTFS handler (CInStream::GetCuSize in NtfsHandler.cpp), which is part of the full 7-Zip application and is not present in the LZMA SDK. Document Filters consumes LZMA SDK 23.01, whose Archive directory ships only the 7z, LZMA, XZ, and Split handlers; NtfsHandler.cpp does not exist in the SDK distribution and is not included in the Document Filters build source list (external/CMakeLists.txt). The vulnerable GetCuSize function is therefore never compiled or reachable. |
| 26.1 | 7-zip (23.01) | Not Affected | Code Not Present | The vulnerability exists in the NTFS handler (CInStream::GetCuSize in NtfsHandler.cpp), which is part of the full 7-Zip application and is not present in the LZMA SDK. Document Filters consumes LZMA SDK 23.01, whose Archive directory ships only the 7z, LZMA, XZ, and Split handlers; NtfsHandler.cpp does not exist in the SDK distribution and is not included in the Document Filters build source list (external/CMakeLists.txt). The vulnerable GetCuSize function is therefore never compiled or reachable. |
| 25.4 | 7-zip (23.01) | Not Affected | Code Not Present | The vulnerability exists in the NTFS handler (CInStream::GetCuSize in NtfsHandler.cpp), which is part of the full 7-Zip application and is not present in the LZMA SDK. Document Filters consumes LZMA SDK 23.01, whose Archive directory ships only the 7z, LZMA, XZ, and Split handlers; NtfsHandler.cpp does not exist in the SDK distribution and is not included in the Document Filters build source list (external/CMakeLists.txt). The vulnerable GetCuSize function is therefore never compiled or reachable. |
| 25.3 | 7-zip (23.01) | Not Affected | Code Not Present | The vulnerability exists in the NTFS handler (CInStream::GetCuSize in NtfsHandler.cpp), which is part of the full 7-Zip application and is not present in the LZMA SDK. Document Filters consumes LZMA SDK 23.01, whose Archive directory ships only the 7z, LZMA, XZ, and Split handlers; NtfsHandler.cpp does not exist in the SDK distribution and is not included in the Document Filters build source list (external/CMakeLists.txt). The vulnerable GetCuSize function is therefore never compiled or reachable. |
| 25.2 | 7-zip (23.01) | Not Affected | Code Not Present | The vulnerability exists in the NTFS handler (CInStream::GetCuSize in NtfsHandler.cpp), which is part of the full 7-Zip application and is not present in the LZMA SDK. Document Filters consumes LZMA SDK 23.01, whose Archive directory ships only the 7z, LZMA, XZ, and Split handlers; NtfsHandler.cpp does not exist in the SDK distribution and is not included in the Document Filters build source list (external/CMakeLists.txt). The vulnerable GetCuSize function is therefore never compiled or reachable. |
| 25.1 | 7-zip (23.01) | Not Affected | Code Not Present | The vulnerability exists in the NTFS handler (CInStream::GetCuSize in NtfsHandler.cpp), which is part of the full 7-Zip application and is not present in the LZMA SDK. Document Filters consumes LZMA SDK 23.01, whose Archive directory ships only the 7z, LZMA, XZ, and Split handlers; NtfsHandler.cpp does not exist in the SDK distribution and is not included in the Document Filters build source list (external/CMakeLists.txt). The vulnerable GetCuSize function is therefore never compiled or reachable. |
| 24.4 | 7-zip (23.01) | Not Affected | Code Not Present | The vulnerability exists in the NTFS handler (CInStream::GetCuSize in NtfsHandler.cpp), which is part of the full 7-Zip application and is not present in the LZMA SDK. Document Filters consumes LZMA SDK 23.01, whose Archive directory ships only the 7z, LZMA, XZ, and Split handlers; NtfsHandler.cpp does not exist in the SDK distribution and is not included in the Document Filters build source list (external/CMakeLists.txt). The vulnerable GetCuSize function is therefore never compiled or reachable. |
| 24.4.0 | 7-zip (23.01) | Not Affected | Code Not Present | The vulnerability exists in the NTFS handler (CInStream::GetCuSize in NtfsHandler.cpp), which is part of the full 7-Zip application and is not present in the LZMA SDK. Document Filters consumes LZMA SDK 23.01, whose Archive directory ships only the 7z, LZMA, XZ, and Split handlers; NtfsHandler.cpp does not exist in the SDK distribution and is not included in the Document Filters build source list (external/CMakeLists.txt). The vulnerable GetCuSize function is therefore never compiled or reachable. |
| 24.3 | 7-zip (23.01) | Not Affected | Code Not Present | The vulnerability exists in the NTFS handler (CInStream::GetCuSize in NtfsHandler.cpp), which is part of the full 7-Zip application and is not present in the LZMA SDK. Document Filters consumes LZMA SDK 23.01, whose Archive directory ships only the 7z, LZMA, XZ, and Split handlers; NtfsHandler.cpp does not exist in the SDK distribution and is not included in the Document Filters build source list (external/CMakeLists.txt). The vulnerable GetCuSize function is therefore never compiled or reachable. |
| 24.2 | 7-zip (23.01) | Not Affected | Code Not Present | The vulnerability exists in the NTFS handler (CInStream::GetCuSize in NtfsHandler.cpp), which is part of the full 7-Zip application and is not present in the LZMA SDK. Document Filters consumes LZMA SDK 23.01, whose Archive directory ships only the 7z, LZMA, XZ, and Split handlers; NtfsHandler.cpp does not exist in the SDK distribution and is not included in the Document Filters build source list (external/CMakeLists.txt). The vulnerable GetCuSize function is therefore never compiled or reachable. |
| 24.1 | 7-zip (23.01) | Not Affected | Code Not Present | The vulnerability exists in the NTFS handler (CInStream::GetCuSize in NtfsHandler.cpp), which is part of the full 7-Zip application and is not present in the LZMA SDK. Document Filters consumes LZMA SDK 23.01, whose Archive directory ships only the 7z, LZMA, XZ, and Split handlers; NtfsHandler.cpp does not exist in the SDK distribution and is not included in the Document Filters build source list (external/CMakeLists.txt). The vulnerable GetCuSize function is therefore never compiled or reachable. |
| 23.3 | 7-zip (23.01) | Not Affected | Code Not Present | The vulnerability exists in the NTFS handler (CInStream::GetCuSize in NtfsHandler.cpp), which is part of the full 7-Zip application and is not present in the LZMA SDK. Document Filters consumes LZMA SDK 23.01, whose Archive directory ships only the 7z, LZMA, XZ, and Split handlers; NtfsHandler.cpp does not exist in the SDK distribution and is not included in the Document Filters build source list (external/CMakeLists.txt). The vulnerable GetCuSize function is therefore never compiled or reachable. |
| 23.2 | 7-zip (17.01) | Not Affected | Code Not Present | The vulnerability exists in the NTFS handler (CInStream::GetCuSize in NtfsHandler.cpp), which is part of the full 7-Zip application and is not present in the LZMA SDK. Document Filters consumes LZMA SDK 23.01, whose Archive directory ships only the 7z, LZMA, XZ, and Split handlers; NtfsHandler.cpp does not exist in the SDK distribution and is not included in the Document Filters build source list (external/CMakeLists.txt). The vulnerable GetCuSize function is therefore never compiled or reachable. |
| 23.1 | 7-zip (17.01) | Not Affected | Code Not Present | The vulnerability exists in the NTFS handler (CInStream::GetCuSize in NtfsHandler.cpp), which is part of the full 7-Zip application and is not present in the LZMA SDK. Document Filters consumes LZMA SDK 23.01, whose Archive directory ships only the 7z, LZMA, XZ, and Split handlers; NtfsHandler.cpp does not exist in the SDK distribution and is not included in the Document Filters build source list (external/CMakeLists.txt). The vulnerable GetCuSize function is therefore never compiled or reachable. |
| 22.4 | 7-zip (17.01) | Not Affected | Code Not Present | The vulnerability exists in the NTFS handler (CInStream::GetCuSize in NtfsHandler.cpp), which is part of the full 7-Zip application and is not present in the LZMA SDK. Document Filters consumes LZMA SDK 23.01, whose Archive directory ships only the 7z, LZMA, XZ, and Split handlers; NtfsHandler.cpp does not exist in the SDK distribution and is not included in the Document Filters build source list (external/CMakeLists.txt). The vulnerable GetCuSize function is therefore never compiled or reachable. |
Severity score breakdown
Attack Complexity
LOW
Attack Vector
NETWORK
Availability Impact
HIGH
Base Score
8.8
Base Severity
HIGH
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Privileges Required
NONE
Scope
UNCHANGED
User Interaction
REQUIRED
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Version
3.1