horkimhab/cve-2026-48095CVE-2026-48095
7-Zip is a file archiver with a high compression ratio. Versions 26.00 and prior contain a heap buffer overflow vulnerability caused by an under-allocation in the NTFS compressed stream buffer (GetCuSize shift UB), potentially allowing attackers to cause arbitrary code execution or application crashes. CInStream::GetCuSize() in the NTFS handler computes the compression-unit buffer size as (UInt32)1 << (BlockSizeLog + CompressionUnit), and a crafted image with ClusterSizeLog >= 28 and CompressionUnit == 4 drives the exponent to 32, which is undefined behavior and collapses on x86/x64 so _inBuf is allocated as 1 byte. ReadStream_FALSE then writes up to 256 MB of attacker-controlled data into that 1-byte buffer in 64 KB iterations, and because the CInStream object sits only 304 bytes after _inBuf, its vtable pointer is overwritten and the next dispatched call achieves a vtable hijack. On 32-bit builds the overflow is unconditionally reached; on 64-bit it requires the parallel 8 GB _outBuf allocation to succeed, otherwise failing closed to denial of service. The NTFS handler is enabled by default in stock 7z.dll and, via signature-based fallback matching "NTFS " at offset 3, will open a crafted image regardless of file extension during extraction or testing. Version 26.01 fixes the issue.
Use this project only in safe and authorized environments such as:
Example setup:
git clone <repository-url>
cd <repository-name>
Example usage:
# Install dependencies
# Run the project
python cve-2026-48095.py
# Specify output file name
python cve-2026-48095.py poc_ntfs_sparse.zip
A repository for learning, testing, and researching cybersecurity concepts in controlled environments.
This repository is for educational and authorized security research only.
It is designed to help users learn about:
Use this repository only in environments where you have permission, such as:
Unauthorized or illegal use is strictly prohibited.
The author and contributors are not responsible for any damage, misuse, legal issues, or losses caused by this project.
By using this repository, you agree that:
This project is intended for:
Please follow responsible disclosure practices and comply with all applicable laws.
For responsible disclosure or collaboration, contact the repository maintainer through GitHub.