7-Zip released version 26.02 to address a critical remote code execution vulnerability in its handling of XZ-compressed data. The flaw, discovered by researcher Landon Peng, can be triggered when a user opens a specially crafted archive file, exploiting a heap-based buffer overflow to execute arbitrary code with the user’s privileges.
The vulnerability stems from improper handling of available buffer space during XZ decompression. While 7-Zip has not disclosed full technical details, code changes in version 26.02 point to memory management issues in the decompression routine. Exploitation requires user interaction, such as opening a malicious archive downloaded from a phishing email or compromised website.
7-Zip’s popularity makes it a privileged target for attackers. In November 2025, NHS England reported active exploitation of a separate 7-Zip remote code execution vulnerability, tracked as CVE-2025-11001, in real-world attacks.
Unlike many modern applications, 7-Zip does not provide automatic updates. Users must manually download and install version 26.02 from the official 7-Zip website. Security teams should prioritize updating 7-Zip across their organizations and implement controls to block untrusted archive files where possible.
