PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-48095 mcmilk CVE debrief

CVE-2026-48095 is a high-severity heap buffer overflow vulnerability in 7-Zip, a popular file archiver. Versions 26.00 and prior are affected, allowing for code execution or application crashes. The vulnerability is caused by an under-allocation in the NTFS compressed stream buffer. To mitigate, upgrade to version 26.01 or later.

Vendor
mcmilk
Product
7-Zip
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-05
Original CVE updated
2026-06-08
Advisory published
2026-06-05
Advisory updated
2026-06-08

Who should care

Users of 7-Zip versions 26.00 and prior should upgrade to version 26.01 or later to address this vulnerability.

Technical summary

The vulnerability is caused by an under-allocation in the NTFS compressed stream buffer (GetCuSize shift UB) in CInStream::GetCuSize(). A crafted image with ClusterSizeLog >= 28 and CompressionUnit == 4 can drive the exponent to 32, resulting in undefined behavior and a 1-byte buffer allocation. ReadStream_FALSE can then write up to 256 MB of attacker-controlled data into that buffer, potentially allowing for code execution or application crashes.

Defensive priority

High

Recommended defensive actions

  • Upgrade to 7-Zip version 26.01 or later.
  • Avoid opening untrusted images with 7-Zip versions 26.00 and prior.

Evidence notes

CVE-2026-48095 has a CVSS score of 8.8 and is considered HIGH severity. The vulnerability is exploitable remotely and requires no user interaction.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-48095 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-48095

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-48095 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-48095

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.