CVE-2026-58052
7-Zip - Mark-of-the-Web Bypass via RAR5 Alternate Data Stream Name Collision
7-Zip for Windows through 26.01 fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive, because its guard that suppresses an archive-supplied Zone.Identifier stream matches the exact name 'Zone.Identifier' while a RAR5 STM record named ':Zone.Identifier:$DATA' is not matched and NTFS canonicalizes it to the same stream, overwriting the propagated Internet-zone marker with ZoneId=0. A second STM record named '::$DATA' overwrites the extracted file's default data stream, letting an attacker defeat SmartScreen/MotW warnings and spoof file content.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
7-Zip - Mark-of-the-Web Bypass via RAR5 Alternate Data Stream Name Collision
7-Zip for Windows through 26.01 fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive, because its guard that suppresses an archive-supplied Zone.Identifier stream matches the exact name 'Zone.Identifier' while a RAR5 STM record named ':Zone.Identifier:$DATA' is not matched and NTFS canonicalizes it to the same stream, overwriting the propagated Internet-zone marker with ZoneId=0. A second STM record named '::$DATA' overwrites the extracted file's default data stream, letting an attacker defeat SmartScreen/MotW warnings and spoof file content.
- Record
CVE-2026-58052- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-693
- Updated
- 2026-11-02
EUVDEUVD-2026-39972
7-Zip for Windows through 26.01 fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive, because its guard that suppresses an archive-supplied Zone.Identifier stream matches the exact name 'Zone.Identifier' while a RAR5 STM record named ':Zone.Identifier:$DATA' is not matched and NTFS canonicalizes it to the same stream, overwriting the propagated Internet-zone marker with ZoneId=0. A second STM record named '::$DATA' overwrites the extracted file's default data stream, letting an attacker defeat SmartScreen/MotW warnings and spoof file content.
- Record
EUVD-2026-39972- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-fx33-p83c-vpr5
7-Zip for Windows through 26.02 fails to preserve the Mark-of-the-Web when extracting a crafted...
7-Zip for Windows through 26.02 fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive, because its guard that suppresses an archive-supplied Zone.Identifier stream matches the exact name 'Zone.Identifier' while a RAR5 STM record named ':Zone.Identifier:$DATA' is not matched and NTFS canonicalizes it to the same stream, overwriting the propagated Internet-zone marker with ZoneId=0. A second STM record named '::$DATA' overwrites the extracted file's default data stream, letting an attacker defeat SmartScreen/MotW warnings and spoof file content.
- Record
GHSA-fx33-p83c-vpr5- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-693
- Updated
- 2026-11-02
NVD
7-Zip for Windows through 26.01 fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive, because its guard that suppresses an archive-supplied Zone.Identifier stream matches the exact name 'Zone.Identifier' while a RAR5 STM record named ':Zone.Identifier:$DATA' is not matched and NTFS canonicalizes it to the same stream, overwriting the propagated Internet-zone marker with ZoneId=0. A second STM record named '::$DATA' overwrites the extracted file's default data stream, letting an attacker defeat SmartScreen/MotW warnings and spoof file content.
- Record
CVE-2026-58052- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-693
- Updated
- 2026-11-02
OSV
7-Zip - Mark-of-the-Web Bypass via RAR5 Alternate Data Stream Name Collision
7-Zip for Windows through 26.01 fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive, because its guard that suppresses an archive-supplied Zone.Identifier stream matches the exact name 'Zone.Identifier' while a RAR5 STM record named ':Zone.Identifier:$DATA' is not matched and NTFS canonicalizes it to the same stream, overwriting the propagated Internet-zone marker with ZoneId=0. A second STM record named '::$DATA' overwrites the extracted file's default data stream, letting an attacker defeat SmartScreen/MotW warnings and spoof file content.
- Record
CVE-2026-58052- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-693
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-58052
7-Zip for Windows through 26.01 fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive, because its guard that suppresses an archive-supplied Zone.Identifier stream matches the exact name 'Zone.Identifier' while a RAR5 STM record named ':Zone.Identifier:$DATA' is not matched and NTFS canonicalizes it to the same stream, overwriting the propagated Internet-zone marker with ZoneId=0. A second STM record named '::$DATA' overwrites the extracted file's default data stream, letting an attacker defeat SmartScreen/MotW warnings and spoof file content.
- Record
DEBIAN-CVE-2026-58052- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVJLSEC-2026-1169
7-Zip for Windows fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive
7-Zip for Windows through 26.01 fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive, because its guard that suppresses an archive-supplied Zone.Identifier stream matches the exact name 'Zone.Identifier' while a RAR5 STM record named ':Zone.Identifier:$DATA' is not matched and NTFS canonicalizes it to the same stream, overwriting the propagated Internet-zone marker with ZoneId=0. A second STM record named '::$DATA' overwrites the extracted file's default data stream, letting an attacker defeat SmartScreen/MotW warnings and spoof file content.
- Record
JLSEC-2026-1169- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11777-1 No score
liblzmasdk26-26.03-1.1 on GA media
These are all security issues fixed in the liblzmasdk26-26.03-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11777-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11792-1 No score
7zip-26.03-1.1 on GA media
These are all security issues fixed in the 7zip-26.03-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11792-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
7zipDebian:12 |
All versions, plus listed versions 22.01+dfsg-10~exp122.01+dfsg-822.01+dfsg-8+deb12u122.01+dfsg-922.01+really25.01+dfsg-0+deb12u1 Show 45 moreShow less22.01+really26.01+dfsg-0+deb12u122.01+really26.02+dfsg-0+deb12u123.01+dfsg-123.01+dfsg-1023.01+dfsg-1123.01+dfsg-1223.01+dfsg-223.01+dfsg-323.01+dfsg-423.01+dfsg-4~exp123.01+dfsg-523.01+dfsg-623.01+dfsg-723.01+dfsg-823.01+dfsg-924.05+dfsg-124.05+dfsg-224.05+dfsg-324.06+dfsg-124.06+dfsg-224.06+dfsg-324.06+dfsg-424.07+dfsg-124.07+dfsg-224.08+dfsg-124.08+dfsg-1~bpo12+124.08+dfsg-224.09+dfsg-124.09+dfsg-224.09+dfsg-2~bpo12+124.09+dfsg-324.09+dfsg-424.09+dfsg-524.09+dfsg-624.09+dfsg-724.09+dfsg-7~bpo12+124.09+dfsg-824.09+dfsg-8~bpo12+125.00+dfsg-125.01+dfsg-125.01+dfsg-1~deb13u125.01+dfsg-1~deb13u1~bpo12+125.01+dfsg-1~deb13u225.01+dfsg-225.01+dfsg-3 |
None known |
7zipDebian:13 |
All versions, plus listed versions 24.09+dfsg-825.00+dfsg-125.01+dfsg-125.01+dfsg-1~deb13u125.01+dfsg-1~deb13u1~bpo12+1 Show 23 moreShow less25.01+dfsg-1~deb13u225.01+dfsg-225.01+dfsg-325.01+dfsg-425.01+dfsg-526.00+dfsg-126.00+dfsg-226.00+dfsg-326.00+dfsg-426.00+dfsg-526.00+dfsg1-126.00+dfsg1-226.00+dfsg1-326.01+dfsg-126.01+dfsg-226.01+dfsg-326.02+dfsg-126.02+dfsg-226.02+dfsg-326.03+dfsg-126.03+dfsg-226.03+dfsg-326.04+dfsg-1 |
None known |
7zipDebian:14 |
before 26.03+dfsg-1, plus listed versions 24.09+dfsg-825.00+dfsg-125.01+dfsg-125.01+dfsg-1~deb13u125.01+dfsg-1~deb13u1~bpo12+1 Show 19 moreShow less25.01+dfsg-1~deb13u225.01+dfsg-225.01+dfsg-325.01+dfsg-425.01+dfsg-526.00+dfsg-126.00+dfsg-226.00+dfsg-326.00+dfsg-426.00+dfsg-526.00+dfsg1-126.00+dfsg1-226.00+dfsg1-326.01+dfsg-126.01+dfsg-226.01+dfsg-326.02+dfsg-126.02+dfsg-226.02+dfsg-3 |
26.03+dfsg-1 |
p7zipDebian:12 |
All versions, plus listed versions 16.02+dfsg-816.02+really25.01+dfsg-0+deb12u116.02+really26.01+dfsg-0+deb12u116.02+really26.02+dfsg-0+deb12u116.02+transitional.1 |
None known |
p7zipDebian:13 |
before 16.02+transitional.1 | 16.02+transitional.1 |
p7zip_jllJulia |
All versions | None known |
lzma-sdkopenSUSE:Tumbleweed |
before 26.03-1.1 | 26.03-1.1 |
7zipopenSUSE:Tumbleweed |
before 26.03-1.1 | 26.03-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-58052 is a medium vulnerability (CVSS 4.8) in 7-zip, published June 28, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.17%, the 6th percentile. Fixed in 7zip 26.03+dfsg-1.
References
github.com/bikini/exploitarium/tree/main/7zip-rar5-motw-chain-poc
vulncheck.com/advisories/7-zip-mark-of-the-web-bypass-via-rar5-alternate-data-stream-name-collision
nvd.nist.gov/vuln/detail/CVE-2026-58052
security-tracker.debian.org/tracker/CVE-2026-58052
suse.com/security/cve/CVE-2026-58052
Left out here: 20 versions. The JSON record has them.