Heap Buffer Overflow RCE in 7-Zip NTFS Archive Handler

CVE-2026-48095 is a heap buffer write overflow in 7-Zip’s NTFS archive handler, disclosed as GHSL-2026-140. The flaw is in CInStream::GetCuSize() in NtfsHandler.cpp, where the NTFS compression-unit buffer size is computed using a left-shift expression on a 32-bit value. A crafted NTFS image can cause the shift exponent to reach 32, triggering undefined behavior and resulting in severe under-allocation of the _inBuf buffer, reportedly down to 1 byte on affected platforms. Subsequent processing then writes attacker-controlled compressed-stream data into this undersized heap buffer, causing a large heap overwrite. Public technical analysis indicates the overflow can corrupt adjacent heap objects, including the CInStream object and its vtable pointer, enabling a vtable hijack and potential arbitrary code execution. The vulnerable parser can be reached through 7-Zip’s signature-based handler fallback, so a malicious NTFS image may be disguised with extensions such as .7z, .zip, .rar, or other non-NTFS names and still be parsed by the NTFS handler. The issue affects 7-Zip through version 26.00 and is fixed in 26.01.