CVE-2026-58052 7-Zip CVE debrief

Who should care

Users of 7-Zip for Windows through version 26.01, cybersecurity teams monitoring for potential file content spoofing and bypassing of SmartScreen/MotW warnings, organizations relying on 7-Zip for file archiving and extraction, and security teams responsible for vulnerability management and incident response should be aware of this vulnerability and take appropriate actions to mitigate potential risks.

Technical summary

The vulnerability occurs because 7-Zip's guard against an archive-supplied Zone.Identifier stream only matches the exact name 'Zone.Identifier', while a RAR5 STM record named ':Zone.Identifier:$DATA' is not matched. NTFS canonicalizes this to the same stream, allowing an attacker to overwrite the propagated Internet-zone marker with ZoneId=0. A second STM record named '::$DATA' can overwrite the extracted file's default data stream, enabling an attacker to bypass SmartScreen/MotW warnings and potentially spoof file content.

Defensive priority

Medium-priority defensive actions are recommended due to the CVSS score of 4.8 and potential impact on file content spoofing and bypassing SmartScreen/MotW warnings.

Recommended defensive actions

• Inventory and check for 7-Zip versions through 26.01
• Implement compensating controls to monitor and track file content changes
• Apply vendor remediation when available
• Monitor for suspicious RAR5 archive extractions
• Exception tracking for potential bypassed files
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Evidence from the NVD and CVE.org indicates that 7-Zip for Windows through version 26.01 is vulnerable to a Mark-of-the-Web bypass via RAR5 alternate data stream name collision. The vulnerability allows an attacker to defeat SmartScreen/MotW warnings and spoof file content. Further review of affected product deployments is recommended to assess potential exposure and impact. Defenders should verify extracted file integrity and monitor for suspicious RAR5 archive extractions.

Official resources