CVE-2026-48095 is a heap buffer overflow in 7-Zip (mcmilk project) affecting versions 26.00 and prior. The vulnerability occurs in the NTFS handler's CInStream::GetCuSize() function, which calculates the compression-unit buffer size using a left shift operation on (BlockSizeLog + CompressionUnit). When a crafted image has ClusterSizeLog >= 28 and CompressionUnit == 4, the exponent reaches 32, causing undefined behavior that results in allocating only 1 byte for the buffer. Subsequently, ReadStream_FALSE writes up to 256 MB of attacker-controlled data into this undersized buffer, overwriting adjacent memory including the vtable pointer of the CInStream object. This enables vtable hijacking and potential arbitrary code execution or crashes. The NTFS handler is enabled by default and triggered by signature-based fallback matching, allowing exploitation regardless of file extension. On 32-bit builds, the overflow is unconditional; on 64-bit builds, it depends on a parallel 8 GB buffer allocation. The vulnerability is resolved in version 26.01.

Successful exploitation can lead to arbitrary code execution or application crashes due to heap buffer overflow and vtable pointer overwrite. The vulnerability affects confidentiality, integrity, and availability of the affected system. It can be triggered by processing a crafted NTFS image during extraction or testing, regardless of file extension.

Upgrade to 7-Zip version 26.01 or later, which fixes this vulnerability. There is no official patch or temporary fix other than upgrading. Until upgrading, avoid opening or extracting files from untrusted sources that may contain crafted NTFS images.