# Critical 7-Zip Vulnerability Allows Code Execution via Malicious XZ Archives Unpatched systems risk remote code execution when opening specially crafted compressed files. - **Source:** [Security Affairs](https://brifing.si/source/e6c4f5ec-3e1b-4152-a932-056243bd56eb) - **Published:** 2026-07-20 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/010a1b0a-18cd-430d-803a-8f5a8d573144 ## Vulnerability Details A heap-based buffer overflow flaw in 7-Zip's XZ file handling mechanism could allow attackers to execute arbitrary code when users open malicious archives. Discovered by researcher Landon Peng, this vulnerability enables privilege escalation by exploiting improper memory buffer management during decompression. ## Attack Vector Exploitation requires user interaction, such as opening a crafted archive or visiting a malicious webpage. This makes the vulnerability particularly dangerous when combined with social engineering attacks. Phishing campaigns distributing weaponized archives pose significant risks to unpatched systems. ## Update Imperative Since 7-Zip lacks automatic updates, users must manually install version 26.02 to mitigate this risk. The software's widespread popularity makes this vulnerability an attractive target for attackers. Millions of systems remain vulnerable until updated. ## Historical Context In November 2025, NHS England reported active exploitation of a similar remote code execution vulnerability (CVE-2025-11001). Such incidents in critical infrastructure highlight the importance of prompt patching for compression software vulnerabilities. ## Technical Insights While developers haven't disclosed full technical details, code changes in version 26.02 suggest improper buffer space handling during XZ decompression. Attackers can craft archives that overflow memory buffers to gain control over execution flow. ## Protection Measures Users should immediately download the latest version from 7-Zip's official site, avoid opening suspicious email attachments, and keep firewalls updated. Enterprise users may benefit from network-level filtering of XZ files as additional protection. ## Sources covering this story - https://securityaffairs.com/195688/security/critical-7-zip-flaw-allows-code-execution-by-opening-crafted-xz-compressed-files-update-it-now.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._