CVE-2026-58052: 7-Zip Information Disclosure Vulnerability

CVE-2026-58052 Overview

CVE-2026-58052 is a Mark-of-the-Web (MotW) bypass in 7-Zip for Windows through version 26.02. The archiver fails to preserve the Internet-zone marker when extracting a crafted RAR5 archive. 7-Zip's guard only matches the exact stream name Zone.Identifier, but a RAR5 STM record named :Zone.Identifier:$DATA bypasses the check. NTFS then canonicalizes it to the same stream, overwriting the propagated MotW with ZoneId=0. A second STM record named ::$DATA overwrites the default data stream, letting an attacker defeat SmartScreen warnings and spoof file content. This vulnerability is classified under [CWE-693] (Protection Mechanism Failure).

Critical Impact
An attacker who convinces a user to extract a crafted RAR5 archive can strip SmartScreen and Mark-of-the-Web protections while replacing the extracted file's contents with attacker-chosen data.

Affected Products

7-Zip for Windows versions up to and including 26.02
Windows systems where extracted files reside on NTFS volumes
Downstream tools and workflows that rely on MotW to trigger SmartScreen and Office Protected View

Discovery Timeline

2026-06-28 - CVE-2026-58052 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-58052

Vulnerability Analysis

Mark-of-the-Web is an NTFS Alternate Data Stream (ADS) named Zone.Identifier that Windows attaches to files downloaded from the Internet. Applications such as SmartScreen, Office Protected View, and Windows Defender rely on the ZoneId value inside this stream to gate execution. When 7-Zip extracts an archive that originated from the Internet, it is expected to propagate that marker onto extracted files.

7-Zip's RAR5 handler processes STM (stream) records to write NTFS Alternate Data Streams alongside extracted files. To prevent an attacker-controlled archive from injecting its own Zone.Identifier, 7-Zip filters STM records whose name equals the literal string Zone.Identifier. The filter is a case-sensitive exact-name comparison and does not account for NTFS stream syntax variants.

Because NTFS canonicalizes stream names, the archive-supplied stream lands on the same underlying Zone.Identifier ADS that 7-Zip writes after extraction. The archive value, which sets ZoneId=0 (local machine), overwrites the propagated Internet-zone marker. A separate STM record named ::$DATA targets the default unnamed data stream and replaces the file's real contents.

Root Cause

The root cause is an incomplete input-validation filter in the RAR5 STM handling code. The guard compares stream names against the literal Zone.Identifier but ignores the equivalent NTFS forms :Zone.Identifier:$DATA and ::$DATA. NTFS treats these as the same underlying streams, so the guard fails to block them.

Attack Vector

Exploitation requires user interaction. An attacker delivers a crafted RAR5 archive through email, web download, or messaging. The user downloads the archive, which receives MotW, then extracts it with 7-Zip. The extracted file loses its Internet-zone marker and gains attacker-supplied content, so SmartScreen and Protected View do not warn when the file is opened. Public proof-of-concept material is documented in the VulnCheck Security Advisory and the GitHub PoC Repository.

Detection Methods for CVE-2026-58052

Indicators of Compromise

RAR5 archives containing STM records with stream names :Zone.Identifier:$DATA or ::$DATA
Extracted files that have a Zone.Identifier ADS with ZoneId=0 despite the parent archive carrying ZoneId=3
File hash mismatches between the archive's advertised content and the extracted default data stream

Detection Strategies

Inspect RAR5 archives for STM records whose names resolve to reserved NTFS streams before allowing extraction
Post-extraction, verify that each file's Zone.Identifier stream matches the parent archive's zone value
Compare the hash of the extracted default data stream against any embedded manifest to detect ::$DATA overwrites

Monitoring Recommendations

Log process launches of 7zFM.exe, 7zG.exe, and 7z.exe with archive paths and downstream child processes
Alert on documents and executables opened from user directories with ZoneId=0 shortly after archive extraction
Track SmartScreen bypass events and Office Protected View exits that occur immediately after RAR extraction

How to Mitigate CVE-2026-58052

Immediate Actions Required

Inventory endpoints running 7-Zip and identify installs at version 26.02 or earlier
Restrict extraction of RAR5 archives from untrusted senders until a fixed build is deployed
Communicate the risk to users so they avoid extracting archives received from external sources
Enable application control policies that block execution of files lacking a valid MotW when sourced from archives

Patch Information

At the time of publication, the upstream fix status should be verified on the 7-Zip GitHub Project Repository. Administrators should track releases beyond 26.02 and deploy the first version that removes the STM name-collision path. Consult the VulnCheck Security Advisory for the vendor's remediation status.

Workarounds

Use an alternate archiver that correctly propagates Mark-of-the-Web on RAR5 extraction until 7-Zip is updated
Configure Windows Attack Surface Reduction rules to block Office child processes and executables launched from archive contents
Strip attacker-controlled ADS entries by scanning extracted directories with dir /r and removing unexpected streams
Enforce SmartScreen and Protected View via Group Policy so users cannot dismiss warnings on files that still carry MotW

bash

# Enumerate Alternate Data Streams in an extracted directory
dir /r "C:\Users\%USERNAME%\Downloads\extracted"

# Inspect the Zone.Identifier stream for an extracted file
Get-Content -Path .\suspicious.docx -Stream Zone.Identifier

# Remove an attacker-supplied Zone.Identifier stream to restore prompts
Remove-Item -Path .\suspicious.docx -Stream Zone.Identifier