CVE-2026-58052: 
7-Zip vulnerability analysis and mitigation

CVE-2026-58052 is a Mark-of-the-Web (MotW) bypass vulnerability in 7-Zip for Windows that allows an attacker to defeat SmartScreen/MotW warnings and spoof file content when a victim extracts a crafted RAR5 archive. It affects all 7-Zip for Windows versions through 26.02 and was published on June 28, 2026. The vulnerability was assigned by VulnCheck and carries a CVSS v3.1 base score of 3.3 (Low) and a CVSS v4.0 base score of 4.8 (Medium) (GitHub Advisory, VulnCheck).

The root cause is a Protection Mechanism Failure (CWE-693) in 7-Zip's handling of RAR5 STM (stream) records on Windows NTFS. 7-Zip's guard against archive-supplied Zone.Identifier alternate data streams (ADS) performs an exact string match on the name Zone.Identifier, but fails to match the variant name :Zone.Identifier:$DATA. Because NTFS canonicalizes both names to the same underlying ADS, the crafted stream overwrites the propagated Internet-zone marker with ZoneId=0, effectively clearing the MotW flag. A second STM record named ::$DATA exploits the same NTFS canonicalization to overwrite the extracted file's default data stream, enabling full file content spoofing. Exploitation requires no privileges and only passive user interaction (opening/extracting the archive) (GitHub Advisory, PoC Repository).

Successful exploitation allows an attacker to silently strip the Mark-of-the-Web from files extracted from a malicious RAR5 archive, causing Windows SmartScreen to treat the extracted files as locally trusted rather than Internet-sourced. Additionally, the attacker can replace the visible content of the extracted file with arbitrary attacker-controlled data via the ::$DATA stream trick, enabling file content spoofing. There is no direct confidentiality or availability impact, but the integrity bypass significantly lowers the barrier for follow-on social engineering or malware delivery attacks against users who rely on SmartScreen warnings as a security control (GitHub Advisory, VulnCheck).

1. Craft the malicious RAR5 archive: Using the public PoC script (poc.py) or manually, build a RAR5 archive containing: (a) a benign-looking main file entry (e.g., invoice.docx) with innocuous visible bytes; (b) a RAR5 STM record named ::$DATA containing attacker-controlled file content to replace the extracted file's default data stream; (c) a RAR5 STM record named :Zone.Identifier:$DATA containing [ZoneTransfer]\r\nZoneId=0\r\n to overwrite the MotW marker.
2. Mark the archive as Internet-zone: Attach a Zone.Identifier ADS to the crafted RAR5 file itself with ZoneId=3 (Internet zone), so 7-Zip's MotW propagation logic is triggered during extraction.
3. Deliver the archive to the victim: Distribute the crafted .rar file via email attachment, web download, or other social engineering vector.
4. Victim extracts with 7-Zip: When the victim opens the archive with 7-Zip (≤26.02) and extracts the file, 7-Zip propagates the Internet-zone marker but its guard only blocks the exact name Zone.Identifier. The :Zone.Identifier:$DATA STM record bypasses the guard and NTFS writes it to the same ADS, setting ZoneId=0.
5. SmartScreen bypass achieved: The extracted file now carries ZoneId=0 (local zone), so Windows SmartScreen does not warn the user when they open it. The file's visible content is also replaced by the attacker's ::$DATA payload, completing the content spoof (PoC Repository, VulnCheck).

• File System: Extracted files from RAR5 archives with a Zone.Identifier ADS containing ZoneId=0 despite the source archive originating from the Internet (ZoneId=3); presence of files whose visible content differs from what is shown in the archive preview.
• File System: RAR5 archives containing STM records with names :Zone.Identifier:$DATA or ::$DATA (detectable via RAR5-aware forensic tools or hex inspection of the archive structure).
• Logs: Windows Event Logs or file system audit logs showing creation of NTFS alternate data streams with non-standard names (:Zone.Identifier:$DATA) on recently extracted files.
• Process: 7-Zip (7z.exe or 7zG.exe) spawning extraction of .rar files from user download directories, followed by the extracted file being opened without a SmartScreen prompt (PoC Repository).

No official patch from 7-Zip has been confirmed as of the disclosure date; users should update to any version of 7-Zip released after 26.02 once available (GitHub Advisory). As an interim workaround, avoid extracting RAR5 archives from untrusted or Internet-sourced locations using 7-Zip, and independently verify file integrity and authenticity before opening extracted files. Consider using alternative archive tools that correctly preserve MotW for RAR5 archives, or manually inspect the Zone.Identifier ADS of extracted files using more < file:Zone.Identifier before execution. Organizations should also consider enabling additional application control policies (e.g., AppLocker, WDAC) to reduce reliance on SmartScreen as a sole defense (VulnCheck).

Infosecurity Magazine covered the vulnerability in the context of the exploitarium PoC repository, highlighting the researcher's demonstration of the full exploitation chain (Infosecurity Magazine). The VulnDB and VulDB communities tracked the issue shortly after disclosure, and it was discussed on Mastodon/infosec.exchange by vulnerability tracking accounts. The GitHub Advisory Database classified it as Moderate severity, and Tenable released a Nessus detection plugin (plugin ID 324932) for the vulnerability (Tenable).