--- title: Update now: 7-Zip fixes RCE flaw exploitable with... description: 7-Zip version 26.02 patches a remote code execution vulnerability (CVE tracked by Zero Day Initiative as ZDI-26-444) caused by a heap-based buffer overflow in... canonical: https://daily.dev/posts/update-now-7-zip-fixes-rce-flaw-exploitable-with-malicious-archives-oi5ch3dwc twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Update now: 7-Zip fixes RCE flaw exploitable with malicious archives | daily.dev og:description: 7-Zip version 26.02 patches a remote code execution vulnerability (CVE tracked by Zero Day Initiative as ZDI-26-444) caused by a heap-based buffer overflow in... og:url: https://daily.dev/posts/update-now-7-zip-fixes-rce-flaw-exploitable-with-malicious-archives-oi5ch3dwc og:image: https://api.daily.dev/og/posts/oI5Ch3dwc.png og:image:alt: Update now: 7-Zip fixes RCE flaw exploitable with malicious archives og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Update now: 7-Zip fixes RCE flaw exploitable with malicious archives **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 2 min read · 13 upvotes · 0 comments ## Summary 7-Zip version 26.02 patches a remote code execution vulnerability (CVE tracked by Zero Day Initiative as ZDI-26-444) caused by a heap-based buffer overflow in XZ-compressed data processing. An attacker can exploit it by tricking a user into opening a specially crafted archive. Since 7-Zip has no auto-update mechanism, users must manually download and install the fix from 7-zip.org. Past 7-Zip and WinRAR vulnerabilities have been actively exploited in real-world attacks, making prompt patching critical. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What vulnerability does 7-Zip 26.02 fix? 7-Zip version 26.02 fixes a remote code execution vulnerability in its handling of XZ-compressed data, disclosed by researcher Landon Peng through the Zero Day Initiative as ZDI-26-444. Specially crafted XZ data can trigger a heap-based buffer overflow, letting attackers execute arbitrary code as the user. The patch adds checks preventing the decoder from writing beyond the output buffer's remaining space. Exploitation requires user interaction, such as opening a malicious archive or visiting a malicious page. _Track archive-utility CVEs like this one on daily.dev before they hit your patch queue._ ### Does 7-Zip update itself automatically after a security patch? No, 7-Zip has no automatic update feature, so security fixes like version 26.02 are not applied automatically. Users must manually download and install the latest version from the official 7-zip.org site to get the RCE fix for the XZ decompression buffer overflow. This makes timely manual patching essential whenever a new security advisory is published. _Developers relying on manual patching workflows follow tool-specific advisories like this on daily.dev._ ### Have 7-Zip or WinRAR vulnerabilities been exploited by hackers before? Yes, in early 2025 a 7-Zip vulnerability that bypassed Windows' Mark of the Web security feature was exploited by Russian hackers as a zero-day, and later that year a Russian hacking group exploited a WinRAR flaw tracked as CVE-2025-8088 via phishing to install the RomCom malware. Archive utility vulnerabilities are recurring targets since these tools are widely deployed on Windows. _Security teams tracking recurring archive-tool exploits stay ahead of the pattern on daily.dev._ ## Similar posts on daily.dev - [CVE-2026-14266: Inside the 7-Zip Heap Overflow Hiding in XZ Archives Since 2021](https://daily.dev/posts/cve-2026-14266-inside-the-7-zip-heap-overflow-hiding-in-xz-archives-since-2021-bfyx6nvg2) · Latest Hacking News · 0 upvotes · 0 comments - [Hackers Actively Exploiting 7-Zip Symbolic Link–Based RCE Vulnerability \(CVE-2025-11001\)](https://daily.dev/posts/hackers-actively-exploiting-7-zip-symbolic-link-based-rce-vulnerability-cve-2025-11001--hzcl4jrdf) · The Hacker News · 0 upvotes · 0 comments - [The “Unzip” of Death: Why Using Your Old WinRAR Is a Dangerous Trap](https://daily.dev/posts/the-unzip-of-death-why-using-your-old-winrar-is-a-dangerous-trap-bwbzk88fe) · InfoSec Write-ups · 0 upvotes · 0 comments --- Tags: [#vulnerability](https://daily.dev/tags/vulnerability) [View this post on daily.dev](https://daily.dev/posts/update-now-7-zip-fixes-rce-flaw-exploitable-with-malicious-archives-oi5ch3dwc) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Update now: 7-Zip fixes RCE flaw exploitable with malicious archives","url":"https://daily.dev/posts/update-now-7-zip-fixes-rce-flaw-exploitable-with-malicious-archives-oi5ch3dwc","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/update-now-7-zip-fixes-rce-flaw-exploitable-with-malicious-archives-oi5ch3dwc"},"datePublished":"2026-07-18T19:34:46.598Z","dateModified":"2026-09-14T07:49:58.493Z","description":"7-Zip version 26.02 patches a remote code execution vulnerability (CVE tracked by Zero Day Initiative as ZDI-26-444) caused by a heap-based buffer overflow in...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8200ad5c85a4dd7e0c776d07856d13ef?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8200ad5c85a4dd7e0c776d07856d13ef?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/update-now-7-zip-fixes-rce-flaw-exploitable-with-malicious-archives-oi5ch3dwc","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":13},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"vulnerability","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Update now: 7-Zip fixes RCE flaw exploitable with malicious archives"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/update-now-7-zip-fixes-rce-flaw-exploitable-with-malicious-archives-oi5ch3dwc#faq","mainEntity":[{"@type":"Question","name":"What vulnerability does 7-Zip 26.02 fix?","acceptedAnswer":{"@type":"Answer","text":"7-Zip version 26.02 fixes a remote code execution vulnerability in its handling of XZ-compressed data, disclosed by researcher Landon Peng through the Zero Day Initiative as ZDI-26-444. Specially crafted XZ data can trigger a heap-based buffer overflow, letting attackers execute arbitrary code as the user. The patch adds checks preventing the decoder from writing beyond the output buffer's remaining space. Exploitation requires user interaction, such as opening a malicious archive or visiting a malicious page. Track archive-utility CVEs like this one on daily.dev before they hit your patch queue."}},{"@type":"Question","name":"Does 7-Zip update itself automatically after a security patch?","acceptedAnswer":{"@type":"Answer","text":"No, 7-Zip has no automatic update feature, so security fixes like version 26.02 are not applied automatically. Users must manually download and install the latest version from the official 7-zip.org site to get the RCE fix for the XZ decompression buffer overflow. This makes timely manual patching essential whenever a new security advisory is published. Developers relying on manual patching workflows follow tool-specific advisories like this on daily.dev."}},{"@type":"Question","name":"Have 7-Zip or WinRAR vulnerabilities been exploited by hackers before?","acceptedAnswer":{"@type":"Answer","text":"Yes, in early 2025 a 7-Zip vulnerability that bypassed Windows' Mark of the Web security feature was exploited by Russian hackers as a zero-day, and later that year a Russian hacking group exploited a WinRAR flaw tracked as CVE-2025-8088 via phishing to install the RomCom malware. Archive utility vulnerabilities are recurring targets since these tools are widely deployed on Windows. Security teams tracking recurring archive-tool exploits stay ahead of the pattern on daily.dev."}}]} ```