New 7

Cybersecuritynews •Guru Baran • May 26, 2026

A critical heap buffer overflow vulnerability has been disclosed in 7-Zip version 26.00, enabling attackers to achieve arbitrary code execution via a vtable hijack by exploiting a defect in the tool’s NTFS archive handler. Tracked as CVE-2026-48095 and assigned advisory GHSL-2026-140, the flaw resides in the CInStream::GetCuSize() function inside NtfsHandler.cpp. The function computes the NTFS […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in 7-Zip Enable Code Execution Attacks A critical heap buffer overflow vulnerability has been identified in 7-Zip version 26.00, allowing attackers to execute arbitrary code through a vtable hijack. This flaw, tracked as CVE-2026-48095 and assigned advisory GHSL-2026-140, affects the NTFS archive handler, specifically within the CInStream::GetCuSize() function in NtfsHandler.cpp. Attackers can exploit this vulnerability by crafting malicious archive files that, when opened by victims, can lead to remote code execution and sensitive data leakage. The GitHub Security Lab has disclosed this vulnerability, emphasizing its severity. Users of 7-Zip are advised to update to the latest version to mitigate risks associated with this flaw. 6 sources 73

Extracted Entities

New 7

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Tools (1)