7-Zip contains a heap buffer overflow in the NTFS compressed stream handler due to an under‑allocation when computing the compression‑unit buffer size. The vulnerability allows an attacker to craft an archive that causes a 1‑byte buffer to be overwritten with up to 256 MB of attacker‑controlled data, culminating in a vtable hijack and arbitrary code execution. If the overflow is not reached, the error triggers a denial of service through a crash. The flaw is rooted in improper arithmetic and lack of bounds checking (CWE‑190, CWE‑787).

The issue affects 7‑Zip versions 26.00 and earlier, including the default stock 7z.dll. Any installation of those releases may process NTFS compressed streams during extraction or file testing. Version 26.01 and later contain the remediation.

The CVSS score of 8.8 indicates a high impact and mitigation needed. EPSS is not available, so the probability of immediate exploitation is uncertain, but because the flaw is triggered by user‑supplied archived files, the attack surface is broad. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is an adversary sending a malicious archive that the target system opens or verifies, which can be triggered during extraction or during a file‑test operation. Once the malicious data has been processed, the attacker can gain code execution on the system running 7‑Zip.