What happened
Quickly: 7‑Zip pushed version 26.02 to fix a nasty remote code execution bug that could let a booby‑trapped archive run code when someone opens it. The issue lives in how 7‑Zip unpacks XZ‑compressed data and can lead to a heap-based buffer overflow if an attacker feeds specially crafted XZ streams to the extractor.
The flaw was reported by a security researcher and disclosed in an advisory. The fix patches the decoder so it checks available output space and refuses to write past the buffer boundary — basically adding a seatbelt where previously there was none.
Exploitation isn’t automatic: an attacker would need to trick a user into opening a malicious archive or visiting a page that forces the app to process the bad data.
What you should do (and why it’s not paranoia)
7‑Zip doesn’t auto-update, so this one won’t land on your PC by itself. You need to grab the new build manually from the official site (look for version 26.02) and install it. Treat it like changing a smoke alarm battery — annoying, but worth it.
- Download and install 7‑Zip version 26.02 from the official download page — do it yourself; it won’t do itself.
- Avoid opening archives from strangers or sketchy emails. Phishing and social engineering are the usual delivery methods for this kind of trick.
- Scan suspicious archives in a sandbox or VM before opening on your main machine.
- Keep backups and endpoint protections up to date so a successful trick doesn’t ruin your week.
Why the rush? Archive tools are a juicy target because people trust compressed files. Similar archive bugs have been weaponized in the past to slip malware past defenses, so even though there are no reports (yet) of active attacks exploiting this specific bug, it’s smart to patch now.