{"id":"ECHO-a273-202b-9560","summary":"Windows-only. The flaw is that 7-Zip for Windows fails to preserve the\nMark-of-the-Web when extracting a crafted RAR5 archive, because a\nRAR5 STM record named ':Zone.Identifier:$DATA' / '::$DATA' is\ncanonicalized by NTFS transparent Alternate Data Streams to overwrite the\npropagated Internet-zone marker / default data stream, defeating\nSmartScreen/MotW. MotW, Zone.Identifier ADS and NTFS :$DATA\ncanonicalization do not exist on Linux (ntfs-3g does not do transparent\nADS canonicalization), so the Echo Linux build is not affected. Debian\nmarks trixie \u003cignored\u003e for the same reason.\n","modified":"2026-09-15T00:47:45.126158273Z","published":"2026-07-19T16:41:19.923Z","withdrawn":"2026-07-19T16:41:19.923Z","upstream":["CVE-2026-58052"],"references":[{"type":"WEB","url":"https://advisory.echohq.com/cve/CVE-2026-58052"}],"affected":[{"package":{"name":"7zip","ecosystem":"Echo","purl":"pkg:deb/echo/7zip"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.01+dfsg-1~deb13u2"}]}],"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-a273-202b-9560.json"}}],"schema_version":"1.9.0"}