Loading story…
A technical writeup detailed how a flaw in andyherbert’s lz1/lz77 decompression routine can be exploited to achieve remote code execution by supplying crafted compressed data. The bug arises because the decompressor limits coding_pos using uncompressed_size, but an inner copy loop continues incrementing coding_pos without enforcing the same boundary, allowing writes past the end of uncompressed_text. The first four bytes of attacker-controlled input determine uncompressed_size, and pointer metadata such as length can then be abused to trigger an out-of-bounds write.
The demonstrated exploitation path replaced heap allocation with stack allocation using alloca, turning the overflow into a stack-based attack capable of overwriting adjacent variables, saved frame data, and the return address. In a statically compiled, non-PIE amd64 binary, the exploit used a ROP chain to call _dl_make_stacks_executable, pivoted execution with a jmp rsp gadget, and ran shellcode that opened a reverse shell. The author noted that earlier fuzzing with afl-fuzz had already uncovered crashing inputs tied to the vulnerable logic.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
STAR Labs published a technical writeup showing how a buffer overflow in andyherbert's lz1/lz77 decompression routine can be exploited for code execution using crafted compressed input. The article details a stack-based exploitation approach with ROP and shellcode against a statically compiled, non-PIE amd64 binary.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed **CVE-2026-48095**, a critical heap buffer overflow in 7-Zip affecting version `26.00` and earlier that can lead to application crashes, denial of service, or arbitrary code execution. The bug, reported by Jaroslav Lobačevski of GitHub Security Lab and tracked in advisory `GHSL-2026-140`, resides in the NTFS archive handler’s `CInStream::GetCuSize()` logic, where an under-allocation can shrink a buffer to 1 byte before a later operation writes up to 256 MB of attacker-controlled data into it. The resulting heap corruption can overwrite adjacent objects, including a stream object’s **vtable** pointer, creating a path to code execution. The vulnerability can be triggered simply by opening a specially crafted file because 7-Zip uses signature-based fallback detection and may route files disguised as `.7z`, `.zip`, or `.rar` into the vulnerable NTFS parser regardless of extension. Reports say both 32-bit and 64-bit builds are affected, with 64-bit systems that have sufficient memory more likely to reach reliable code execution, while lower-memory systems may instead crash. Public disclosure included technical details and a Python proof-of-concept generator, raising the risk of weaponization; the issue carries a **CVSS 3.1 score of 8.8**, and users are being urged to update 7-Zip and avoid opening untrusted archives.
Jun 29, 2026
A critical global buffer overflow vulnerability has been identified in the *zlib* untgz utility, specifically affecting version 1.3.1.2. The flaw resides in the `TGZfname()` function, where an unbounded `strcpy()` operation copies user-supplied archive names from command-line arguments into a fixed-size global buffer of 1,024 bytes without proper length validation. Security researchers demonstrated that supplying an archive name exceeding this limit can trigger an out-of-bounds write, leading to memory corruption, denial-of-service, or potentially arbitrary code execution, depending on system configuration and compiler settings. The vulnerability, tracked as `CVE-2026-22184` with a CVSS score of 9.3, is trivially exploitable via command-line input and does not require any archive parsing or validation to trigger. Successful exploitation was confirmed using AddressSanitizer, which detected a global buffer overflow when the utility was invoked with a 4,096-byte filename. The issue is classified under CWE-120 (Buffer Copy without Checking Size of Input) and poses significant risk to systems utilizing the affected version of the untgz utility for archive extraction or processing.
Jun 29, 2026
A critical vulnerability in **7-Zip** tracked as `CVE-2026-48095` and `GHSL-2026-140` allows attackers to trigger a heap-based buffer overflow when a user opens a specially crafted archive containing an **NTFS volume image**. The flaw affects **7-Zip 26.00 and earlier** and stems from incorrect buffer size calculations and insufficient boundary checks in the NTFS handler, where a computed buffer can shrink to **1 byte** while later logic writes up to **256 MB** of attacker-controlled data into it. Researchers said the bug can cause memory corruption, crashes, denial of service, and potentially **arbitrary code execution**, including through possible vtable pointer overwrite under favorable conditions. The vulnerable NTFS handler is enabled by default in stock `7z.dll`, and exploitation does not depend on a specific file extension because 7-Zip uses signature-based fallback matching for NTFS images. The issue was privately reported to the developers in April and fixed in **7-Zip 26.01**, with vendor and researcher advisories later published alongside a Python proof-of-concept. With 7-Zip widely deployed on Windows and Linux systems and embedded in automated workflows and other software, defenders have little mitigation beyond upgrading to the patched release because no workaround has been identified.
Jun 29, 2026