A serious 7-Zip security flaw could allow attackers to execute malicious code through specially crafted archive files.
The vulnerability affects how the popular Windows utility processes XZ-compressed data. An attacker must convince the victim to open a malicious archive or visit a page that triggers the vulnerable component.
Version 26.02 fixes the issue. However, 7-Zip does not update automatically, so users must download and install the new version manually.
Malicious Archives Trigger the Vulnerability
The 7-Zip security flaw involves a heap-based buffer overflow during the decompression of XZ data.
A specially designed archive can cause the program to write information beyond the available space in an output buffer. As a result, memory corruption may occur.
An attacker could potentially abuse that corruption to execute arbitrary code on the affected computer. The malicious code would run with the same permissions as the current user.
Therefore, an attacker who compromises an administrator account could gain extensive control over the system. A user with limited permissions would reduce the potential damage, although personal and business data could still remain at risk.
User Interaction Is Required
Attackers cannot exploit the vulnerability remotely without some form of user interaction.
The victim must open a malicious archive or interact with content that sends specially crafted XZ data to 7-Zip.
Cybercriminals could distribute such files through phishing emails, fraudulent software downloads, messaging platforms, or compromised websites. They may disguise the archive as an invoice, application form, company document, or software package.
Because compressed archives frequently appear in legitimate business communication, recipients may not immediately recognize the danger.
Update Adds New Buffer Checks
The developer has not published a full technical explanation of the 7-Zip security flaw.
However, changes in version 26.02 indicate that the problem involves how the program tracks available space while decompressing XZ data.
The updated code adds checks that prevent the decoder from writing beyond the remaining space in the output buffer. Consequently, the patch blocks the memory corruption that could lead to code execution.
Users should install version 26.02 or later to receive the protection.
7-Zip Has No Automatic Updates
Unlike many modern applications, 7-Zip does not include an automatic update feature.
Therefore, affected users will not receive version 26.02 without taking action. They must manually download the latest installer and complete the update.
This limitation may leave many systems exposed long after a security fix becomes available. It creates a particular concern for organizations that use 7-Zip across large numbers of employee devices.
IT teams should identify every installation within their environment. They can then deploy the patched version through their normal software management tools.
Afterward, administrators should confirm that older versions no longer remain on company systems.
Archive Flaws Attract Attackers
7-Zip is one of the most widely used archive utilities on Windows. As a result, vulnerabilities in its file-processing features can provide attractive opportunities for cybercriminals.
Attackers commonly use compressed files to bypass security controls and conceal malicious content. A vulnerability inside the archive utility itself can make those campaigns even more dangerous.
Previous attacks have already exploited security flaws in popular archive programs.
In early 2025, Russian hackers exploited a different 7-Zip vulnerability as a zero-day. That flaw allowed malicious archives to bypass the Windows Mark of the Web security protection.
Later that year, another Russian-linked group exploited a WinRAR vulnerability through phishing attacks. The campaign used malicious archives to install RomCom malware.
These incidents demonstrate how quickly criminals can incorporate archive vulnerabilities into real attacks.
No Active Attacks Detected Yet
Security researchers have not reported active exploitation of the newly disclosed 7-Zip security flaw.
However, that situation could change after attackers analyze the patched code and develop working exploits. Public information about the security update may also draw attention to the vulnerable component.
Users should therefore install version 26.02 before attacks appear.
Meanwhile, organizations should continue blocking suspicious archives and scanning email attachments. Employees should also avoid opening unexpected compressed files, even when they appear to come from a familiar contact.
0 responses to “7-Zip Security Flaw Allows Code Execution Through Archives”