Free Archive Program 7-Zip Can Be Hacked With a Malicious File

The free 7-Zip file-archiving program for Windows can be exploited to deliver malware via a malicious XZ file or website, according to a recently posted advisory. Researchers say the issue appears tied to how 7-Zip processes the XZ compression format, where specially crafted XZ data can trigger a coding error leading to a buffer overflow and overwrite of adjacent memory. The report attributes discovery to researcher Landon Peng, while the advisory is associated with the Zero Day Initiative, which discloses vulnerabilities. Exploitation requires user interaction: the victim must visit a malicious page or open a malicious file. 7-Zip was patched with a June 25 update (version 26.02), but it lacks auto-update, meaning users must manually install the latest version. WinRAR is noted as having similar, non-auto-updating issues.