7-Zip Patch Fixes Critical Code Execution Vulnerability in XZ Archives
A critical remote code execution vulnerability in 7-Zip allows attackers to execute malicious code by tricking users into opening specially crafted compressed files. Researcher Landon Peng disclosed the flaw, which stems from how the popular archive utility processes XZ-compressed data. Specially crafted XZ files trigger a heap-based buffer overflow that gives attackers the ability to run arbitrary code with the user's privileges.
The developer addresses the issue in version 26.02 by adding checks that prevent the decoder from writing beyond the available space in an output buffer. Because 7-Zip does not include an automatic update feature, users must manually download the patched release from the official 7-zip.org website. Given the tool's massive popularity on Windows, archive vulnerabilities remain an attractive target for threat actors.
Exploitation requires user interaction such as visiting a malicious webpage or opening a booby-trapped archive, making phishing and social engineering the most likely attack vectors. There are currently no reports of active exploitation, but archive utility flaws have been weaponized in past attacks by state-sponsored hacking groups. Security experts urge all users to update immediately to reduce the risk of future campaigns.