GHSL-2026-140: Heap Buffer Write Overflow in 7-Zip
Published May 22, 2026
·Updated
A heap buffer overflow vulnerability (GHSL-2026-140) exists in 7-Zip version 26.00, caused by an under-allocation in the NTFS compressed stream buffer (GetCuSize shift UB), potentially allowing attackers to exploit this issue for arbitrary code execution.
Affected Software
1 affected component
7-Zip 7-Zip=26.00
Event History
May 22, 2026
Advisory Published
via GitHub Security Lab·12:00 AM
Data Sourced
via GitHub Security Lab·12:00 AM
Description
Frequently Asked Questions
1
What is the severity of GHSL-2026-140?
The severity of GHSL-2026-140 is rated at 77, indicating a high risk level.
2
How do I fix GHSL-2026-140?
To mitigate GHSL-2026-140, update 7-Zip to the latest version beyond 26.00 as soon as possible.
3
What causes the GHSL-2026-140 vulnerability?
GHSL-2026-140 is caused by an under-allocation in the NTFS compressed stream buffer, leading to a heap buffer overflow.
4
What are the potential impacts of GHSL-2026-140?
Exploiting GHSL-2026-140 may allow attackers to execute arbitrary code on affected systems.
5
Which version of 7-Zip is affected by GHSL-2026-140?
GHSL-2026-140 affects 7-Zip version 26.00.