7-Zip model 26.02 was launched to repair a distant code execution vulnerability that would enable an attacker to execute malicious code by persuading an attacker to open a specifically crafted compressed file.
The vulnerability, disclosed by Lunabun researcher Landon Peng, exists in 7-Zip’s dealing with of XZ compressed knowledge.
In response to an advisory from the Zero Day Initiative, specifically crafted XZ knowledge may cause a heap-based buffer overflow that would enable an attacker to execute arbitrary code because the consumer.
The builders haven’t launched technical particulars in regards to the flaw, however the adjustments within the 26.02 supply code counsel it’s associated to the way in which 7-Zip tracks accessible area when unzipping XZ knowledge.
This patch provides checks to make sure that the decoder can not write past the remaining accessible area within the output buffer, serving to forestall heap-based buffer overflows.
The advisory states that exploitation requires consumer interplay, equivalent to visiting a malicious web page or opening a malicious archive file.
No computerized replace function
7-Zip doesn’t embrace an computerized replace function, so customers is not going to routinely obtain safety fixes. As an alternative, it’s worthwhile to obtain the newest model from this system’s official web site 7-zip.org and set up it manually.
7-Zip is likely one of the most generally used archiving utilities in Home windows, so safety flaws that have an effect on its archiving performance make it a horny goal for menace actors.
Phishing campaigns and social engineering assaults can be utilized to distribute malicious archives that exploit flaws to put in malware on susceptible methods.
This isn’t far-fetched, as vulnerabilities in archives, together with 7-Zip, have been exploited in previous assaults.
In early 2025, Russian hackers exploited a zero-day vulnerability in 7-Zip that allowed malware to bypass Home windows’ Mark of the Net (MotW) safety function.
Later that 12 months, a bunch of Russian hackers used a phishing assault to take advantage of a vulnerability in WinRAR, tracked as CVE-2025-8088, and set up RomCom malware.
At the moment, there aren’t any studies of attackers actively exploiting this newly disclosed 7-Zip vulnerability.
Nevertheless, we advocate updating to model 26.02 as quickly as attainable to scale back the danger of future assaults.
Safety groups doc 54% of profitable assaults and subject a warning on solely 14%. The remaining strikes invisibly by way of the atmosphere.
Picus’ whitepaper exhibits methods to take a look at your SIEM and EDR guidelines in breach and assault simulations to make sure threats go undetected.
Get the white paper
