A critical vulnerability has been discovered in the popular 7-Zip archive utility that allows attackers to execute malicious code by convincing users to open specially crafted compressed files. The flaw, which was disclosed by researcher Landon Peng, exists in 7-Zip’s processing of XZ-compressed data and can be exploited with user interaction, such as visiting a malicious page or opening a malicious archive file.
The vulnerability, which has been patched in version 26.02 of the software, is related to how 7-Zip tracks available space while decompressing XZ data. The patch adds checks to ensure the decoder cannot write beyond the remaining available space in an output buffer, helping prevent a heap-based buffer overflow.
Because 7-Zip is one of the most widely used archive utilities on Windows, security flaws impacting its archive features are an attractive target to threat actors. A phishing campaign or social engineering attack could be used to distribute a malicious archive that exploits the flaw to install malware on vulnerable systems.
While there are currently no reports that attackers are actively exploiting this newly disclosed 7-Zip vulnerability, users are advised to update to version 26.02 as soon as possible to reduce the risk of future attacks.
Impact and Exploitation
The impact of this vulnerability is significant, as it allows attackers to execute arbitrary code as the user. This can be achieved by convincing users to open a malicious archive file or visiting a malicious page that contains a specially crafted XZ-compressed data.
According to an advisory from the Zero Day Initiative, exploitation requires user interaction, making it a potential target for phishing campaigns and social engineering attacks.
Patching and Mitigation
The vulnerability has been patched in version 26.02 of 7-Zip, which is available for download on the program’s official site. Users are advised to update as soon as possible to reduce the risk of future attacks.
As 7-Zip does not include an automatic update feature, users must install the patch manually by downloading the latest version from the official site.
Related Threats and Exploits
This vulnerability is not an isolated incident, as archive vulnerabilities have been exploited in past attacks. In early 2025, a 7-Zip vulnerability that allowed malware to bypass Windows’ Mark of the Web (MotW) security feature was exploited by Russian hackers as a zero-day.
Later that same year, a Russian hacking group exploited a WinRAR vulnerability tracked as CVE-2025-8088 via phishing attacks to install the RomCom malware.
Conclusion
The critical vulnerability in 7-Zip archive utility exposes users to remote code execution attacks. Users are advised to update to version 26.02 as soon as possible to reduce the risk of future attacks.
It is essential for users to stay vigilant and keep their software up-to-date, especially when it comes to widely used utilities like 7-Zip.
Source: Original article