What is the CVSS score of CVE-2026-48095?

CVE-2026-48095 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of 7 Zip are affected by CVE-2026-48095?

7-Zip versions 26.00 and earlier contain a remote code execution vulnerability in the default-enabled NTFS archive handler that allows attackers to execute arbitrary code when users open crafted…. A patch is available.

How to fix or mitigate CVE-2026-48095?

Within 24 hours: Issue security alert to all users warning against opening archives from untrusted sources; inventory all 7-Zip deployments and versions in use across infrastructure. Within 7 days: Disable the NTFS archive handler via group policy or 7-Zip configuration settings where feasible, implement email gateway rules to block suspicious archives, and establish a monitoring process for vendor patch releases. Within 30 days: Deploy patched 7-Zip version to all endpoints upon vendor release (version TBD pending vendor advisory), or transition to an alternative compression utility if patch timeline becomes unacceptable.

7 Zip CVE-2026-48095

EUVD-2026-34838 HIGH

Out-of-bounds Write (CWE-787)

2026-06-05 GitHub_M

RCE Buffer Overflow Denial Of Service Memory Corruption 7 Zip Suse Mcmilk

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 15:02 vuln.today

DescriptionGitHub Advisory

7-Zip is a file archiver with a high compression ratio. Versions 26.00 and prior contain a heap buffer overflow vulnerability caused by an under-allocation in the NTFS compressed stream buffer (GetCuSize shift UB), potentially allowing attackers to cause arbitrary code execution or application crashes. CInStream::GetCuSize() in the NTFS handler computes the compression-unit buffer size as (UInt32)1 << (BlockSizeLog + CompressionUnit), and a crafted image with ClusterSizeLog >= 28 and CompressionUnit == 4 drives the exponent to 32, which is undefined behavior and collapses on x86/x64 so _inBuf is allocated as 1 byte. ReadStream_FALSE then writes up to 256 MB of attacker-controlled data into that 1-byte buffer in 64 KB iterations, and because the CInStream object sits only 304 bytes after _inBuf, its vtable pointer is overwritten and the next dispatched call achieves a vtable hijack. On 32-bit builds the overflow is unconditionally reached; on 64-bit it requires the parallel 8 GB _outBuf allocation to succeed, otherwise failing closed to denial of service. The NTFS handler is enabled by default in stock 7z.dll and, via signature-based fallback matching "NTFS " at offset 3, will open a crafted image regardless of file extension during extraction or testing. Version 26.01 fixes the issue.

AnalysisAI

Remote code execution in 7-Zip versions 26.00 and earlier is achievable via a crafted NTFS image that triggers a heap buffer overflow in the archive handler, overwriting an adjacent C++ object's vtable pointer to hijack control flow. The flaw stems from an undefined-behavior shift in CInStream::GetCuSize() that under-allocates a buffer to just one byte, which is then written up to 256 MB of attacker-controlled data. Exploitation requires the victim to open or extract a malicious archive (UI:R), but the NTFS handler is enabled by default and is selected via signature matching regardless of file extension; no public exploit identified at time of analysis.

More in 7 Zip

View all

CVE-2016-2334 HIGH Act Now POC

7.8 Dec 13

Heap-based buffer overflow in the NArchive::NHfs::CHandler::ExtractZlibFile method in 7zip before 16.00 and p7zip allows

CVE-2016-2335 HIGH This Week POC

8.8 Jun 07

The CInArchive::ReadFileItem method in Archive/Udf/UdfIn.cpp in 7zip 9.20 and 15.05 beta and p7zip allows remote attacke

CVE-2026-14266 HIGH This Week POC

7.8 Jul 15

Heap-based buffer overflow in 7-Zip's XZ archive parser enables arbitrary code execution when a victim opens a crafted a

CVE-2016-9296 HIGH This Week POC

7.5 Nov 12

A null pointer dereference bug affects the 16.02 and many old versions of p7zip. Rated high severity (CVSS 7.5), this vu

CVE-2022-29072 HIGH This Week POC

7.8 Apr 15

7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is d

CVE-2018-10115 HIGH This Week POC

7.8 May 02

Incorrect initialization logic of RAR decoder objects in 7-Zip 18.03 and before can lead to usage of uninitialized memor

CVE-2018-5996 HIGH This Week POC

7.8 Jan 31

Insufficient exception handling in the method NCompress::NRar3::CDecoder::Code of 7-Zip before 18.00 and p7zip can lead

CVE-2015-1038 MEDIUM This Month POC

5.8 Jan 21

p7zip 9.20.1 allows remote attackers to write to arbitrary files via a symlink attack in an archive. Rated medium severi

CVE-2025-53816 MEDIUM This Month POC

5.5 Jul 17

Heap buffer overflow in 7-Zip's RAR5 handler writes zeroes beyond allocated heap memory, causing memory corruption and d

CVE-2026-58052 MEDIUM This Month POC

4.8 Jun 28

Mark-of-the-Web protection is bypassed in 7-Zip for Windows 26.02 and earlier when extracting crafted RAR5 archives, all

CVE-2018-10172 HIGH This Week

8.8 Apr 16

7-Zip through 18.01 on Windows implements the "Large memory pages" option by calling the LsaAddAccountRights function to

CVE-2016-7804 HIGH This Week

7.8 May 22

Untrusted search path vulnerability in 7 Zip for Windows 16.02 and earlier allows remote attackers to gain privileges vi

Same weakness CWE-787 – Out-of-bounds Write

View all

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2012-1889 HIGH POC

8.8

CVE-2010-3333 HIGH POC

7.8

CVE-2014-1761 HIGH POC

7.8

CVE-2009-3129 HIGH POC

7.8

CVE-2021-1732 HIGH POC

7.8

CVE-2013-3346 CRITICAL POC

9.8

Same technique RCE

View all

CVE-2021-44228 CRITICAL POC

10.0

CVE-2017-7269 CRITICAL POC

9.8

CVE-2022-47966 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2023-3519 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2016-4117 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Performance Computing 15 SP7	Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7	Affected
SUSE Linux Enterprise Server 15 SP7	Affected

CVE-2026-48095 vulnerability details – vuln.today

Back

SUSE Linux Enterprise Server 16.0	Affected
SUSE Linux Enterprise Server 16.1	Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7	Affected
SUSE Linux Enterprise Server for SAP applications 16.0	Affected
SUSE Linux Enterprise Server for SAP applications 16.1	Affected
openSUSE Leap 16.0	Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS	Affected
SUSE Linux Enterprise Server 15 SP4-LTSS	Affected
SUSE Linux Enterprise Server 15 SP5-LTSS	Affected
SUSE Linux Enterprise Server 15 SP6-LTSS	Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP6	Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS	Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP4	Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP5	Affected
openSUSE Leap 15.6	Affected

7 Zip CVE-2026-48095

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

AnalysisAI

More in 7 Zip

Same weakness CWE-787 – Out-of-bounds Write

Same technique RCE

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code