A critical vulnerability has been discovered in 7-Zip, one of the most widely used archive utilities on Windows, allowing attackers to execute malicious code by convincing users to open specially crafted compressed files. The vulnerability, disclosed by researcher Landon Peng, affects 7-Zip’s processing of XZ-compressed data and can be exploited through a remote code execution (RCE) attack.
The issue arises from how 7-Zip tracks available space while decompressing XZ data, which can lead to a heap-based buffer overflow. This means that an attacker could potentially execute arbitrary code as the user by sending a specially crafted XZ archive file. To fix this flaw, the developer has released version 26.02 of 7-Zip, which includes checks to ensure the decoder cannot write beyond the remaining available space in an output buffer.
Unlike some other software, 7-Zip does not include an automatic update feature, so users must install the latest version manually by downloading it from the official site at 7-zip.org. Given that 7-Zip is a widely used utility, security flaws impacting its archive features are particularly attractive to threat actors. Attackers could distribute malicious archives through phishing campaigns or social engineering attacks, exploiting the flaw to install malware on vulnerable systems.
This scenario is not far-fetched, as we’ve seen in the past when vulnerabilities like this have been exploited in real-world attacks. In early 2025, a 7-Zip vulnerability was used by Russian hackers as a zero-day exploit, while later that same year, another Russian hacking group exploited a WinRAR vulnerability via phishing attacks to install malware.
Fortunately, there are currently no reports of attackers actively exploiting this newly disclosed 7-Zip vulnerability. However, users are advised to update to version 26.02 as soon as possible to reduce the risk of future attacks. By taking proactive steps like this, individuals and organizations can help prevent potential security breaches.
In light of this vulnerability, it’s a good reminder for users to be cautious when opening compressed files from unknown sources and to keep their software up-to-date with the latest security patches. This may seem obvious, but in today’s threat landscape, vigilance is crucial in protecting against emerging threats.
Source: Bleeping Computer — 2026-07-18