Malformed ZIP Files Allows Attackers to Bypass Antivirus and EDR Detections

The report describes CVE-2026-0866, a critical weakness in archive handling where deliberately malformed ZIP headers (altered compression-method metadata) can cause antivirus and EDR scanners to fail to decompress and scan archives, allowing embedded malicious payloads to evade detection; attackers pair this with custom loaders that ignore the broken metadata to execute the payload. Cisco is confirmed affected, numerous other vendors have unknown status, and the advisory recommends vendors validate archive content against declared metadata, quarantine inconsistent archives, and hunt for custom loaders.