7-Zip has released version 26.02 of its popular archiving utility to address a remote code execution (RCE) vulnerability. The flaw, which could allow attackers to execute malicious code, is triggered when users open specially crafted compressed files.
The vulnerability was discovered by Lunbun researcher Landon Peng and is related to 7-Zip's handling of XZ-compressed data. According to an advisory, specially crafted XZ data can lead to a heap-based buffer overflow, potentially enabling arbitrary code execution with the privileges of the user.
While detailed technical specifics from the developer are not yet public, an analysis of the 26.02 source code indicates the patch focuses on how 7-Zip manages available space during XZ decompression. The update introduces checks to prevent the decoder from writing beyond the allocated output buffer, thereby mitigating the heap-based buffer overflow.
Exploitation of this vulnerability requires user interaction, such as visiting a malicious webpage or opening a malicious archive file. Given 7-Zip's widespread use on Windows, such vulnerabilities are considered attractive targets for threat actors. Phishing campaigns or social engineering tactics could be employed to distribute malicious archives designed to exploit this flaw and install malware on vulnerable systems.
Users should be aware that 7-Zip does not feature an automatic update mechanism. Consequently, the security fix will not be applied automatically, and users must manually download and install version 26.02 from the official 7-zip.org website.
This is not the first time 7-Zip has faced security challenges. In early 2025, a 7-Zip vulnerability that allowed malware to bypass Windows' Mark of the Web (MotW) security feature was reportedly exploited as a zero-day by Russian hackers. Later that same year, a different Russian hacking group exploited a WinRAR vulnerability, tracked as CVE-2025-8088, through phishing attacks to deploy RomCom malware.
Currently, there are no confirmed reports of active exploitation of this newly disclosed 7-Zip vulnerability. However, users are strongly advised to update to version 26.02 promptly to reduce their risk of future attacks.
