Description
7-Zip for Windows through 26.01 fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive, because its guard that suppresses an archive-supplied Zone.Identifier stream matches the exact name 'Zone.Identifier' while a RAR5 STM record named ':Zone.Identifier:$DATA' is not matched and NTFS canonicalizes it to the same stream, overwriting the propagated Internet-zone marker with ZoneId=0. A second STM record named '::$DATA' overwrites the extracted file's default data stream, letting an attacker defeat SmartScreen/MotW warnings and spoof file content.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| 7-Zip | 7-Zip | ≤ 26.01 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | 7zip | 26.03+dfsg-1 | — |
| Debian 13 | 7zip | No fix yet | — |
| Debian 13 | p7zip | 16.02+transitional.1 | — |
| Debian 12 | 7zip +1 | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | 7zip +1 | 26.03-1.1 | openSUSE-SU-2026:11792-1, openSUSE-SU-2026:11777-1 |
Advisories 3
- WID-SEC-2026-2114 7-Zip: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Oct 6, 2026
- openSUSE-SU-2026:11792-1 7zip-26.03-1.1 on GA media SUSE / openSUSE Security Updates · Sep 17, 2026
- openSUSE-SU-2026:11777-1 liblzmasdk26-26.03-1.1 on GA media SUSE / openSUSE Security Updates · Sep 15, 2026
References
- Proof of Concept exploit third-party-advisory
- 7-Zip source (ip7z/7zip) product
- VulnCheck Advisory: 7-Zip - Mark-of-the-Web Bypass via RAR5 Alternate Data Stream Name Collision third-party-advisory