7-Zip, one of the most widely used free file compression tools on Windows, has released version 26.02 to fix a serious security flaw. The vulnerability allows an attacker to run any program on your computer — including malware — simply by tricking you into opening a specially crafted archive file. No additional clicks or passwords are required once the file is opened.
The flaw is a heap buffer overflow in how 7-Zip processes XZ-compressed data. A maliciously crafted archive can overwrite memory in a way that hands control of the program to the attacker. Security researcher Landon Peng of Lunbun discovered and reported the vulnerability. While there are no confirmed reports of active exploitation yet, proof-of-concept details are now public, meaning attackers are likely to weaponize it quickly. Because 7-Zip has no built-in automatic updates, millions of users remain on vulnerable versions without knowing it.
How to check if you’re affected
Affected versions are any release of 7-Zip older than 26.02. To find your version, open 7-Zip File Manager and go to Help → About 7-Zip. If the version shown is earlier than 26.02, you are at risk. Download the latest version directly from 7-zip.org and install it — the installer will replace the old version automatically. Be cautious with any compressed files (.7z, .xz, .zip) received from unknown senders until you have updated.