Critical 7-Zip vulnerability patched — update to version 26.02 now

Full text

If you use 7-Zip for your file compression and decompression you might want to update, as there's been a pretty big vulnerability patched. And yes, I mean manually update, as 7-Zip doesn't auto-update.

You can download and run a new installer from the 7-Zip website . If you're updated to version 26.02 (or later, if you're reading this in the future) then you'll be fine. To check this, go to Help > About 7-Zip in the app.

The vulnerability, as explained by Zero Day Initiative (via TechSpot ), "allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

"The specific flaw exists within the processing of XZ chunked data. Crafted XZ-compressed data can trigger an overflow of a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process."

It sounds like you'd have to try to use a compromised compressed file in 7-Zip for the exploit to work. This might initially sound like a bit of a nothing burger because compromised files can obviously compromise your PC (duh).

But I'd say the difference here is we don't usually expect the act of decompression itself to cause anything malicious. It seems this vulnerability means that's the kind of thing that could happen, with a compromised file using 7-Zip's exploitable code to do so.

It's worth noting that we've heard word of exploits for other file archivers previously, such as WinRAR . Those also have been patched. In other words, 7-Zip isn't unique in this regard, and in fact the patch advisory was released just a few weeks after the vulnerability was reported to 7-Zip by Lunbun LLC (Landon Peng), according to Zero Day Initiative.

And remember, this fix requires a manual update. So, if you're a 7-Zip user it's definitely worth getting a new version downloaded.