Mark-of-the-Web Bypass in 7-Zip for Windows
CVE-2026-58052

4.8MEDIUM

Key Information:

Vendor

7-zip
Status
7-zip
Vendor
CVE Published:
28 June 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-58052?

7-Zip for Windows versions prior to 26.02 contain a vulnerability that fails to maintain the Mark-of-the-Web when extracting a specially crafted RAR5 archive. This occurs due to improper handling of the Zone.Identifier stream, wherein the application does not effectively recognize a RAR5 Stream record named ':Zone.Identifier:$DATA', leading to potential overwriting of critical data streams. Consequently, attackers can exploit this flaw, effectively circumventing SmartScreen and other security mechanisms, posing a significant risk to users by presenting potentially harmful content as safe.

Affected Version(s)

7-Zip 0 <= 26.01

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-58052 - Proof of Concept

References

https://github.com/bikini/exploitarium/tree/main/7zip-rar...
exploitthird-party-advisory
https://github.com/ip7z/7zip
product
https://www.vulncheck.com/advisories/7-zip-mark-of-the-we...
third-party-advisory

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

ashdfrkl
.