A heap buffer overflow in 7-Zip's XZ decompression lets attackers execute code when victims open crafted archive files.