CVE-2026-0866: Malformed ZIP Headers Allow Malware to Slip Past EDR Scanners

A newly detailed vulnerability, CVE-2026-0866, is highlighting a fundamental blind spot in how many Antivirus (AV) and Endpoint Detection and Response (EDR) tools handle compressed files. By strategically “breaking” the metadata of a ZIP archive, attackers can create “shadow archives” that appear corrupted to security scanners but remain fully functional for malicious execution.

The core of the issue lies in the trust that security engines place in ZIP metadata. Standard archives contain fields that declare the version, flags, and—crucially—the compression method used.

“Antivirus engines typically rely on this metadata to determine how to preprocess files before scanning”. When an attacker intentionally modifies the compression method field, the security software may fail to decompress the file correctly, leading to a false negative where the actual malicious payload remains unanalyzed.

While a tampered ZIP might thwart an EDR, it often confuses standard extraction tools as well. Utilities like 7-Zip or Python’s zipfile module may fail with “unsupported method” errors when encountering these malformed headers.

However, this doesn’t stop the malware. Attackers use custom-coded loaders to bypass the declared (and incorrect) metadata. As the CERT/CC note explains, “After antivirus evasion, the payload can be recovered by using a custom loader that ignores the declared Method field and instead decompresses embedded data directly”.

This technique allows malicious content to stay “hidden” from scanners while remaining programmatically recoverable for execution on the victim’s machine.

This vulnerability is a modern echo of older techniques, specifically drawing comparisons to CVE-2004-0935. While many security products will simply flag the file as “corrupted,” the lack of a full analysis means the specific threat remains unknown.

To successfully execute the hidden code, a user must still extract the archive or run a process that can handle the malformed data. While standard tools might not always reveal the payload, a specialized loader makes the concealed content a potent threat.

CERT/CC is calling on the cybersecurity industry to adopt more “aggressive detection modes”. Security scanners should no longer take archive headers at face value. Instead, they must:

• Validate compression fields against the actual characteristics of the content.
• Flag inconsistencies between metadata and data for deeper inspection.
• Avoid sole reliance on declared metadata for determining how a file is handled.

Update: March 19

This CVE is on “REJECTED” status.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy