THREATOPS
THREAT OPS › Threat News › [NVD] CVE-2026-58052 (LOW 3.3) — 7-Zip for Windows through 26.01 fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive, because its guard that suppresses an archive-supplied Zone.Identifier stream matches the exact name 'Zone.Identifier' while a RAR5 STM record named ':Zone.Identifier:$DAT

[NVD] CVE-2026-58052 (LOW 3.3) — 7-Zip for Windows through 26.01 fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive, because its guard that suppresses an archive-supplied Zone.Identifier stream matches the exact name 'Zone.Identifier' while a RAR5 STM record named ':Zone.Identifier:$DAT

lownvdPublished 2026-06-28

CVE-2026-58052 CVSS: 3.3 LOW Published: 2026-06-28T02:16:32.283

7-Zip for Windows through 26.01 fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive, because its guard that suppresses an archive-supplied Zone.Identifier stream matches the exact name 'Zone.Identifier' while a RAR5 STM record named ':Zone.Identifier:$DATA' is not matched and NTFS canonicalizes it to the same

Indicators of compromise

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-58052