CVE-2026-58052 Details

A vulnerability in 7-Zip for Windows, in versions through 26.02, allows for a Mark-of-the-Web (MotW) bypass when extracting specially crafted RAR5 archives. The issue arises because 7-Zip's mechanism for suppressing archive-supplied Zone.Identifier streams only recognizes the exact name 'Zone.Identifier'. However, a RAR5 stream named ':Zone.Identifier:$DATA' is not properly matched. As a result, the Windows NTFS file system canonicalizes it to the same stream name, overwriting the extracted file's Internet-zone marker with ZoneId=0. Additionally, a second stream named '::$DATA' can replace the file's default data stream, enabling an attacker to circumvent SmartScreen and MotW warnings while manipulating the file's content.