EUVD-2026-39972
GHSA-fx33-p83c-vpr5
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector since extraction occurs on-disk; no privileges needed; user must actively extract the archive (UI:R); impact is integrity-only as the MotW zone data and file content stream are overwritten.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
7-Zip for Windows through 26.02 fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive, because its guard that suppresses an archive-supplied Zone.Identifier stream matches the exact name 'Zone.Identifier' while a RAR5 STM record named ':Zone.Identifier:$DATA' is not matched and NTFS canonicalizes it to the same stream, overwriting the propagated Internet-zone marker with ZoneId=0. A second STM record named '::$DATA' overwrites the extracted file's default data stream, letting an attacker defeat SmartScreen/MotW warnings and spoof file content.
AnalysisAI
Mark-of-the-Web protection is bypassed in 7-Zip for Windows 26.02 and earlier when extracting crafted RAR5 archives, allowing an attacker to strip the Internet-zone marker (ZoneId=0) and spoof the extracted file's data stream content - directly defeating SmartScreen and Windows attachment warnings. The bypass exploits a gap between 7-Zip's exact-string guard ('Zone.Identifier') and the NTFS-canonical equivalent (':Zone.Identifier:$DATA') that a RAR5 STM record can supply; a second STM record ('::$DATA') additionally overwrites the default file data stream for content spoofing. A publicly available proof-of-concept exists; no vendor-released patched version has been confirmed at the time of analysis.
Technical ContextAI
Windows Mark-of-the-Web relies on NTFS Alternate Data Streams (ADS): files downloaded from the internet receive a 'Zone.Identifier' ADS containing 'ZoneId=3', which triggers SmartScreen and UAC warnings on execution. 7-Zip (CPE: cpe:2.3:a:7-zip:7-zip:*:*:*:*:*:*:*:*) attempts to suppress attacker-controlled Zone.Identifier streams during archive extraction to propagate the download's own zone mark - but its guard uses an exact string match against 'Zone.Identifier'. RAR5 archives support STM (stream) records, and a record named ':Zone.Identifier:$DATA' passes 7-Zip's guard undetected because the string does not match exactly. When written to disk, the Windows NTFS kernel canonicalizes ':Zone.Identifier:$DATA' to the same alternate data stream as 'Zone.Identifier', overwriting the legitimate ZoneId=3 with ZoneId=0 (local zone). A second STM record named '::$DATA' canonicalizes to the file's primary data stream, replacing the extracted file's content. CWE-693 (Protection Mechanism Failure) precisely describes the root cause: 7-Zip's own MotW guard fails to account for all valid NTFS stream name representations, creating the bypass.
RemediationAI
No vendor-released patched version has been confirmed in available data at the time of analysis - the 7-Zip source repository (https://github.com/ip7z/7zip) is referenced but no tagged release addressing this issue is identified. Organizations should monitor the 7-Zip project page and the VulnCheck advisory (https://www.vulncheck.com/advisories/7-zip-mark-of-the-web-bypass-via-rar5-alternate-data-stream-name-collision) for a patched release and apply it immediately upon availability. As interim compensating controls: replace 7-Zip with an alternative extractor (e.g., Windows Explorer built-in, WinRAR, or Bandizip) that correctly propagates MotW for RAR5 archives - note this may reduce RAR5 feature support. Configure Windows Attachment Manager Group Policy ('Do not preserve zone information in file attachments') to the inverse (always mark extracted files as Internet zone), though this may cause false-positive SmartScreen triggers for trusted content. Enable Windows Defender ASR rules targeting execution of files from untrusted sources, which adds a compensating layer even when MotW is stripped. Blocking inbound RAR5 files at email gateway or web proxy reduces exposure with the trade-off of blocking legitimate RAR5 content.
Heap-based buffer overflow in the NArchive::NHfs::CHandler::ExtractZlibFile method in 7zip before 16.00 and p7zip allows
The CInArchive::ReadFileItem method in Archive/Udf/UdfIn.cpp in 7zip 9.20 and 15.05 beta and p7zip allows remote attacke
Heap-based buffer overflow in 7-Zip's XZ archive parser enables arbitrary code execution when a victim opens a crafted a
A null pointer dereference bug affects the 16.02 and many old versions of p7zip. Rated high severity (CVSS 7.5), this vu
7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is d
Incorrect initialization logic of RAR decoder objects in 7-Zip 18.03 and before can lead to usage of uninitialized memor
Insufficient exception handling in the method NCompress::NRar3::CDecoder::Code of 7-Zip before 18.00 and p7zip can lead
p7zip 9.20.1 allows remote attackers to write to arbitrary files via a symlink attack in an archive. Rated medium severi
Heap buffer overflow in 7-Zip's RAR5 handler writes zeroes beyond allocated heap memory, causing memory corruption and d
Remote code execution in 7-Zip versions 26.00 and earlier is achievable via a crafted NTFS image that triggers a heap bu
7-Zip through 18.01 on Windows implements the "Large memory pages" option by calling the LsaAddAccountRights function to
Untrusted search path vulnerability in 7 Zip for Windows 16.02 and earlier allows remote attackers to gain privileges vi
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today