New 7-Zip Vulnerabilities Let Attackers Execute Arbitrary Code and Compromise Systems

A critical heap buffer overflow (CVE-2026-48095) in 7-Zip up through 26.00 allows arbitrary code execution when a crafted NTFS image triggers a 32-bit shift undefined behavior in CInStream::GetCuSize, producing a one-byte allocation that is then overwritten leading to a vtable hijack. Both 32- and 64-bit builds are affected, the flaw is extension-agnostic (any file extension matching the NTFS signature can trigger it), and the advisory rates it CVSS 3.1 8.8 — users should update immediately and avoid opening untrusted archives or disk images.