CVE-2026-58052: 7-Zip RAR5 Mark-of-the-Web Bypass on Windows

Technical summary

The vulnerability stems from insufficient stream validation in 7-Zip's RAR5 extraction logic. When processing RAR5 STM (stream) records, 7-Zip uses a guard that only matches the exact string 'Zone.Identifier' to suppress archive-supplied zone markers. However, a crafted RAR5 archive can include a stream named ':Zone.Identifier:$DATA', which NTFS canonicalizes to the same stream as 'Zone.Identifier', bypassing the guard. This overwrites the propagated Internet-zone marker with ZoneId=0, effectively removing the MotW indicator. Additionally, a second STM record named '::$DATA' can overwrite the extracted file's default data stream, allowing arbitrary file content injection. The root cause is CWE-693 (Protection Mechanism Failure), stemming from improper handling of alternative stream naming conventions in NTFS.

Business impact

Organizations relying on 7-Zip for secure file extraction may unknowingly extract malware-laden files that appear safe to Windows security mechanisms. Users could bypass SmartScreen and other file-origin warnings, increasing the risk of successful phishing and drive-by-download attacks. The impact is primarily user-facing but compounds existing social engineering threats. For enterprises using 7-Zip in automated or end-user workflows, this creates a supply-chain trust gap where extraction tools undermine downstream security controls.

Affected systems

7-Zip for Windows through version 26.01 is affected. The vulnerability is specific to Windows NTFS systems where stream canonicalization applies. Non-Windows installations or versions after 26.01 (if patched) are not subject to this flaw. Organizations should audit environments where 7-Zip is deployed for archive processing, particularly in user-facing contexts or untrusted input handling.

Exploitability

Exploitation requires user interaction: an attacker must convince a user to extract a malicious RAR5 file using 7-Zip. The attack surface is local (AV:L), with no network component, and requires no elevated privileges. The bar for crafting a malicious RAR5 archive is moderate—an attacker needs to understand NTFS stream mechanics and RAR5 STM record encoding. However, once deployed, the payload bypasses multiple defensive layers (MotW, SmartScreen), making post-extraction execution more likely. The CVSS score of 3.3 (LOW) reflects the local, user-interaction requirement, though the integrity impact (I:L) captures file content tampering.

Remediation

Organizations should upgrade 7-Zip to a version after 26.01 that properly validates stream names against NTFS canonicalization rules. Verify the vendor's advisory for the specific patched version number and release date. Interim mitigation includes educating users to verify file properties and disable automatic execution of extracted content, though these are not technical fixes. Consider restricting 7-Zip usage to trusted archives or implementing content sandboxing for extracted files.

Patch guidance

Monitor the 7-Zip project for an updated release that addresses improper stream name validation. When available, deploy the patched version organization-wide, prioritizing systems where users extract untrusted RAR5 archives. Test the patch in a non-production environment to ensure compatibility with existing workflows. Verify against the official 7-Zip advisory to confirm the fix includes stream canonicalization handling.

Detection guidance

Detection is difficult at the network level due to the local attack vector, but endpoint monitoring can flag suspicious 7-Zip extraction activity. Look for processes spawning executables from recently extracted archives, or files with MotW stripped after 7-Zip processing. File integrity monitoring can detect unauthorized stream overwrites on NTFS volumes. Organizations with SIEM capability should correlate 7-Zip extraction with subsequent SmartScreen bypass or unsigned executable execution. Consider behavioral heuristics that detect extraction of RAR5 files followed by immediate execution of contained binaries.

Why prioritize this

Although scored as LOW severity, this vulnerability deserves attention because it directly undermines Windows' built-in file-safety warnings. The attack chain—malicious RAR5 → 7-Zip extraction → bypassed MotW → user execution—is realistic and common in phishing campaigns. The flaw is specific and actionable (requiring 7-Zip upgrade), making it suitable for near-term patching cycles. Prioritize based on the prevalence of 7-Zip in your user base and the frequency of external archive handling.

Risk score, explained

CVSS 3.3 reflects a LOW-severity local vulnerability requiring user interaction to trigger. The attack vector is local (AV:L) because the malicious archive must be extracted by the victim. Attack complexity is low (AC:L), as no special conditions are needed beyond a crafted RAR5 file. No privileges are required (PR:N), and the impact is limited to integrity (I:L)—file content modification—with no confidentiality or availability impact. The score appropriately captures the user-interaction gate, but does not weight the downstream risk of bypassing security controls, which may justify prioritization above the numerical score in some environments.

Frequently asked questions