Vulnerability 7-Zip 26.02: urgent patch to prevent remote code execution

Critical vulnerability in 7-Zip: patch available for a remote code execution flaw

The version 26.02 of 7-Zip, released on June 25, fixes a remote code execution vulnerability (CVE not yet assigned) that could allow malicious actors to execute harmful code by convincing users to open specially crafted compressed archives. The flaw, discovered by researcher Landon Peng of Lunbun, affects the XZ file decompression module.

Quick Response

Technical details of the vulnerability

According to the advisory published by the Zero Day Initiative (ZDI-26-444), a specially crafted XZ file can trigger a heap-based buffer overflow, potentially allowing the execution of arbitrary code with user privileges. Changes in the source code of version 26.02 indicate that the flaw is related to how 7-Zip manages available space during XZ file decompression. The patch introduces checks that prevent the decoder from writing beyond the output buffer limits.

Active exploration and attack vectors

The exploration of the vulnerability requires user interaction, such as visiting a malicious website or opening a harmful archive. Although there are currently no reports of active attacks exploiting this flaw, the nature of the vulnerability makes it an appealing target for threat actors. 7-Zip, being one of the most widely used archiving tools on Windows, is a common target for attacks based on compressed archives.

Comparisons with past vulnerabilities

This is not the first time a vulnerability in 7-Zip has been exploited in real attacks. Early in 2025, another flaw in 7-Zip was exploited by Russian hackers as a zero-day to bypass Windows' Mark of the Web (MotW) functionality. In another incident, a Russian hacking group exploited a vulnerability in WinRAR, identified as CVE-2025-8088, through phishing attacks to install the RomCom malware. These precedents highlight the concrete risk that the currently discovered vulnerability could also be exploited in targeted attacks.

Lack of automatic updates and recommendations

One of the most critical aspects is that 7-Zip does not include an automatic update feature. Users must therefore manually download and install the latest version from the official 7-zip.org website to apply the security fix. This manual process represents a significant security risk, as many users may not be aware of the need to update or may postpone the installation of the patch.

Implications for cybersecurity

The widespread use of 7-Zip among Windows users makes it a particularly effective attack vector. Threat actors could exploit this vulnerability in phishing campaigns or social engineering attacks, distributing malicious compressed archives that exploit the flaw to install malware on vulnerable systems. The lack of automatic updates further exacerbates the risk, as many users may not be aware of the need to update immediately.

Best practices for mitigation

To mitigate the risk associated with this vulnerability, organizations and individual users should adopt the following measures: immediately update to 7-Zip version 26.02, educate users about the risks of opening compressed archives from unverified sources, and consider using alternative archiving tools that offer automatic updates and advanced security features. Additionally, implementing robust cybersecurity solutions, such as continuous network traffic monitoring and behavioral analysis, can help detect and prevent attempts to exploit this and other vulnerabilities.

The discovery of this vulnerability in 7-Zip underscores the critical importance of keeping software up to date and adopting proactive security practices. Users and organizations should act immediately to apply the patch and strengthen their defenses against potential attacks that exploit this flaw.