7-Zip (versions below 26.02)

7-Zip's XZ decompression routine failed to track remaining available space in the output buffer correctly. Without that check, the decoder could write beyond the buffer's boundary, corrupting adjacent memory in a way an attacker can control. The fix in version 26.02 adds a boundary check so the decoder stops before overflowing.

An attacker crafts a malicious XZ archive and delivers it via phishing email or a compromised download link. The victim opens the file in 7-Zip. During decompression, the malformed data triggers the buffer overflow. The attacker's code executes with the same privileges as the user who opened the file. No elevated access is needed on the attacker's side — just a convincing enough reason for the victim to open the file. Think of it like a parcel that explodes when the recipient cuts the tape.

Watch for 7-Zip processes spawning unexpected child processes (particularly cmd.exe or PowerShell). Monitor for unusual outbound network connections originating from the 7-Zip process. Check for newly created scheduled tasks or registry run keys appearing immediately after archive extraction.

1. Download and install 7-Zip version 26.02 manually from 7-zip.org — there is no automatic update.
2. Until patched, avoid opening archive files received from unknown senders or unfamiliar websites.
3. If you manage endpoints, consider application control policies that alert on unexpected child processes spawned by archive utilities.