A critical vulnerability has been discovered in the popular file archiver 7-Zip, allowing attackers to inject malicious code into extracted files. The flaw, found in both the latest and previous versions of the software, affects Windows users who download or extract XZ archives from untrusted sources.
The issue arises when a specially crafted XZ archive is created with a malformed header. When this archive is then extracted using 7-Zip, it can execute arbitrary code on the victim’s system. This type of vulnerability is known as an “arbitrary code execution” flaw and allows attackers to bypass security controls by injecting malicious code into otherwise legitimate files.
The vulnerability affects not only individuals but also businesses that rely on 7-Zip for compressing and decompressing large files. Many organizations use the software to distribute files, share archives with collaborators or customers, or simply as a convenient way to manage data storage. The risk of exploitation is higher when users download files from untrusted sources, such as email attachments or websites that may be compromised.
Researchers have warned that attackers can create malicious XZ archives by exploiting the vulnerability in 7-Zip and other compatible software tools. These archives appear normal at first glance but contain a payload of malicious code embedded within the file structure. When an unsuspecting user extracts these files, they inadvertently execute the attacker’s code, which can lead to malware infection or system compromise.
The discovery of this vulnerability highlights the need for users to adopt robust security practices when working with compressed archives and sharing files online. One crucial step is to be cautious when downloading files from unknown sources and never open attachments or extract archives unless explicitly verified as safe by the sender. Furthermore, organizations should review their cybersecurity policies and consider implementing additional controls, such as file scanning software or intrusion detection systems, to mitigate the risks associated with this type of vulnerability.
To stay protected against software vulnerabilities like this one, it is essential to prioritize regular updates for your operating system, software, and security tools. Keep a close eye on reputable sources for patches and advisories related to 7-Zip and other widely used applications. By staying vigilant and taking proactive measures, you can minimize the risk of exploitation and ensure the integrity of your digital assets remains intact.
Source: The Hacker News — 2026-07-20