By ByteBot
CVE-2026-58052 landed in most security queues in late June with a CVSS score of 3.3. Low severity. No Metasploit module, no public proof-of-concept, minimal community chatter. EPSS ranked it near the bottom of its distribution. Every automated scorecard said: deprioritize. Exploitation telemetry from Empirical Security says otherwise — multiple confirmed in-wild attacks through July 2026, with the most recent recorded on July 25. The vulnerability affects 7-Zip through version 26.02, the current release. There is no official patch.
What Mark-of-the-Web Does and Why Losing It Matters
When you download a file from the internet on Windows, the OS attaches a hidden Alternate Data Stream called Zone.Identifier to the file. This stream contains a single value: ZoneId=3, marking the file as internet-origin. Windows Defender SmartScreen reads this marker before allowing execution. Microsoft Office reads it before deciding whether to open a document in Protected View. It is the first gate in the Windows defense-in-depth stack. Without it, downloaded files open as if they came from your local machine — no warnings, no prompts, no friction.
CVE-2026-58052 strips that gate silently during extraction.
How the Attack Works
The root cause is an incomplete string comparison in Is_ZoneId_StreamName(), the function in ArchiveExtractCallback.cpp responsible for blocking archive-supplied Zone.Identifier streams. The guard checks for the exact string "Zone.Identifier" — and nothing else. A RAR5 archive can carry a stream record named :Zone.Identifier:$DATA, which the guard misses but NTFS canonicalizes to the identical stream, silently overwriting the internet-zone marker with ZoneId=0 (local machine, fully trusted). A second record named ::$DATA then replaces the actual file content with the attacker’s payload.
The result: the extracted file has no MotW, contains the attacker’s payload, and opens without a single warning. User interaction required is one click — extracting the archive.
The CVSS Problem Is Exactly What Attackers Are Counting On
CVSS evaluates vulnerability steps in isolation. “Requires user interaction” gets penalized in the score even when, in a real phishing campaign, user interaction means clicking one link in an email. More critically, CVSS does not model kill chains. A MotW bypass is never the final objective — it is the first step that makes every subsequent step easier: code execution, credential theft, lateral movement. Empirical Security’s exploitation-telemetry model places CVE-2026-58052 in the 98th percentile of all scored CVEs despite the 3.3 base score. Picus Security’s 2026 analysis found that 28% of exploited CVEs carry only medium scores. The pattern is not new. Attackers have known for years that low-CVSS MotW bypasses are underpatched and undermonitored.
The Timing Makes It Worse
7-Zip 26.02 was itself a mandatory security update. It patched CVE-2026-14266, a heap overflow in the XZ archive decoder that had existed undetected since 7-Zip 21.07 in 2021 — a five-year exposure window with CVSS 7.0 and potential remote code execution. Any responsible team upgraded to 26.02. In doing so, they moved from a version with a known RCE to a version with an actively-exploited MotW bypass. The patch cycle gave developers a false sense of being current.
What Developers Should Do Right Now
The official 7-Zip release does not yet contain a fix for CVE-2026-58052. Pull Request #235 on the ip7z/7zip GitHub repository contains the patch — it normalizes NTFS stream name handling before the comparison — but has not shipped in a stable release. Here is what to do while waiting:
- Switch to NanaZip 6.5+ for untrusted archives. NanaZip is a 7-Zip derivative maintained by M2Team that has already integrated the PR #235 fix. It is free, open source, and a near-drop-in replacement on Windows.
- Use Windows Explorer for RAR5 extraction. Windows’ native extraction does not have this bug. For ad-hoc extraction of untrusted files, Explorer is safer than 7-Zip right now.
- Audit your CI/CD pipelines. If any build step extracts a RAR5 archive from an external source — vendor SDKs, community toolchains, artifact mirrors — that is a supply chain exposure point. Switch to a patched extractor or block RAR5 at the pipeline level.
- Block RAR5 at email gateways. Add
.rarand multi-part RAR extensions (.r00–.r99) to blocked attachment types. - Track the fix. Watch PR #235 on GitHub and monitor 7-zip.org for a version beyond 26.02.
Patch Scorecards Are Not Threat Models
CVE-2026-58052 is a case study in why CVSS scores cannot be your only triage signal. A 3.3 does not mean ignore — it means the scoring system did not have exploitation telemetry when it assigned the number. Empirical Security did, and they placed it in the 98th percentile. When CVSS and telemetry disagree, telemetry is usually closer to reality. Check what version of 7-Zip is running in your pipelines, on your developer machines, and in your enterprise images. If it is 26.02 or earlier and you extract RAR5 files from untrusted sources, you are exposed right now.
