CVE-2026-58052

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-58052
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-58052.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-58052
Downstream
Published
2026-06-28T01:32:54.971Z
Modified
2026-07-16T03:48:43.878387059Z
Severity
  • 4.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
7-Zip - Mark-of-the-Web Bypass via RAR5 Alternate Data Stream Name Collision
Details

7-Zip for Windows through 26.01 fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive, because its guard that suppresses an archive-supplied Zone.Identifier stream matches the exact name 'Zone.Identifier' while a RAR5 STM record named ':Zone.Identifier:$DATA' is not matched and NTFS canonicalizes it to the same stream, overwriting the propagated Internet-zone marker with ZoneId=0. A second STM record named '::$DATA' overwrites the extracted file's default data stream, letting an attacker defeat SmartScreen/MotW warnings and spoof file content.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-693"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58052.json"
}
References

Affected packages

Git / github.com/ip7z/7zip

Affected ranges

Type
GIT
Repo
https://github.com/ip7z/7zip
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
8c63d71ff886bda90c86db28466287f977374237
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "cpe": "cpe:2.3:a:7-zip:7-zip:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "26.01"
        },
        {
            "last_affected": "26.02"
        }
    ]
}

Affected versions

21.*
21.07
22.*
22.00
22.01
23.*
23.01
24.*
24.05
24.06
24.07
24.08
24.09
25.*
25.00
25.01
26.*
26.00
26.01

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-58052.json"