Users of the 7-Zip file archiver are advised to manually update their software to version 26.02 or later following the discovery and patching of a significant security vulnerability. The vulnerability could allow remote attackers to execute arbitrary code on affected systems.
According to information from Zero Day Initiative, the flaw resides in how 7-Zip processes XZ chunked data. A specially crafted XZ-compressed file can trigger an overflow in a heap-based buffer. Successful exploitation of this vulnerability would enable an attacker to execute code within the context of the current 7-Zip process. This exploit requires user interaction, meaning the target must open a malicious file or visit a compromised webpage.
While any compressed file carries inherent risks if sourced from an untrusted location, this specific vulnerability means that the act of decompression itself could be leveraged for malicious purposes. The issue was reported to 7-Zip by Lunbun LLC, with the patch advisory being released a few weeks after the report was filed.
Unlike some applications, 7-Zip does not feature an auto-update mechanism, necessitating users to actively download and install the latest version from the official 7-Zip website to ensure their system is protected. To verify the current version, users can navigate to Help > About 7-Zip within the application.