Vulnerability · NVD

CVE-2026-58052

CVE-2026-58052, low severity (CVSS 3.3): 1 tracked app concerned, all fixed or indeterminable on their current version.

Severity (CVSS): 3.3
Exploitation: 0.2 %
Tracked apps: 1
Still exposed: 0

Published on 2026-06-28

7-Zip for Windows through 26.01 fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive, because its guard that suppresses an archive-supplied Zone.Identifier stream matches the exact name 'Zone.Identifier' while a RAR5 STM record named ':Zone.Identifier:$DATA' is not matched and NTFS canonicalizes it to the same stream, overwriting the propagated Internet-zone marker with ZoneId=0. A second STM record named '::$DATA' overwrites the extracted file's default data stream, letting an attacker defeat SmartScreen/MotW warnings and spoof file content.

Attack vector : Local No privileges required

Show raw CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

EPSS 0.17% exploit very unlikely percentile 5.7%

Tracked apps referencing this CVE

For each app: the affected range, the fixing version, and where the tracked app stands today.

7-Zip Windows winget:7zip.7zip

Affected ≤26.01 Fixed in > 26.01 Latest tracked 26.03 patched

Observed affected builds (20)

26.01 26.00 25.01 25.00 24.09 24.08 24.07 24.06 24.05 23.01 22.01 22.00 21.07 21.06 19.00 19.00.00.0 18.06 18.05 18.01 16.04

Vulnerable CPE configurations (1)

Vendor	Product	Platform	Versions	CPE 2.3 URI
7-zip	7-zip All platforms (wildcard)	All platforms (wildcard)	≤26.01	cpe:2.3:a:7-zip:7-zip::::::::

View on NVD ↗

Manage your fleet with Appaloosa

Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.

Discover Appaloosa MDM