7-Zip Ships Emergency Fix for Flaw That Lets Booby-Trapped Archives Run Code
Version 26.02 patches a heap buffer overflow in XZ decompression. There is no auto-update, so users have to grab it themselves.
Key points
- 7-Zip released version 26.02 to fix a remote code execution flaw in how it handles XZ-compressed data.
- The bug was reported by Lunbun researcher Landon Peng and disclosed through the Zero Day Initiative.
- Exploiting it requires a user to open a booby-trapped archive or visit a malicious page.
- 7-Zip has no automatic updater, so users must download the new version manually from 7-zip.org.
- No active attacks have been reported, but archive tool flaws have been exploited by Russian-linked actors twice already in 2025.
7-Zip, the free file-compression tool used by millions on Windows, has pushed out an urgent update. Version 26.02 closes a hole that could let an attacker take over a computer if the user opens the wrong file.
The flaw lives in how 7-Zip unpacks XZ files, a compressed format similar to ZIP. Lunbun researcher Landon Peng found that a specially built XZ file can trick the program into writing data into memory it should never touch. That mistake, a heap-based buffer overflow, can be steered by an attacker to run their own code on the victim's machine. The report was handled by the Zero Day Initiative, a Trend Micro program that pays researchers for bug reports and coordinates fixes with vendors. We first covered the Zero Day Initiative on 18 July 2026.
What does this mean for someone who just uses 7-Zip at home or work?
You need to update, and you won't get a pop-up telling you to. 7-Zip has no automatic update feature, so every copy stays vulnerable until the person using it goes to 7-zip.org and installs the new version by hand.
The attack isn't silent. Someone has to open a malicious archive, or visit a page that serves one, for the flaw to fire. That sounds reassuring until you remember how often people do exactly that after clicking a link in an email.
As first reported by BleepingComputer, the developer hasn't published a deep technical writeup. The source code changes in 26.02 tell the story: the patch adds checks so the decoder can't write past the space it's been given in the output buffer.
Has this kind of thing happened before?
Yes, and recently. In early 2025, attackers linked to Russia used a different 7-Zip bug as a zero-day to slip past Mark of the Web, the Windows feature that warns users when they open files downloaded from the internet. Later that year, a Russian group exploited a WinRAR flaw tracked as CVE-2025-8088 via phishing to install malware called RomCom. Archive tools are on almost every Windows machine, they're trusted, and they're a favourite delivery route for malicious code.
It's also worth knowing the 7-Zip name has been weaponised in a different way: fake 7-Zip downloads have been quietly turning home PCs into criminal middlemen, as we reported on 9 July 2026, with over 230 lookalike sites distributing malware.
Should you worry?
Worry is the wrong word. Act is better. Open 7-Zip, check the version number, and if it's older than 26.02 download the new release from 7-zip.org now. IT teams should push the update through their software management tooling and remind staff not to open compressed files from unknown senders.
No one is actively exploiting this bug yet. That's the good news. Details are now public, patches can be reverse-engineered, and the clock is running.
Patching won't feel dramatic. It never does. But archive vulnerabilities have a proven track record of becoming real attacks fast, and this one hands an attacker full code execution the moment a user makes a single ordinary mistake.
