7-Zip 26.02 Patches an Archive Decoder Flaw via ZDI

7-Zip 26.02 Patches an Archive Decoder Flaw Found via ZDI

On July 18, 2026, the 7-Zip project shipped version 26.02, which fixes a memory-safety issue in the utility's archive decoding path. The interesting part is not the bug - bugs happen in every decoder ever written - but the sequence of events around it. A researcher found it, a coordination program handled it, the maintainer shipped a bounds-checked fix, and no in-the-wild exploitation was reported at the time of publication. That is the process working exactly as designed.

Key Takeaways

• The issue is fixed in 7-Zip version 26.02, available from 7-zip.org.
• It was reported by researcher Landon Peng (handle Lunbun) and coordinated through Trend Micro's Zero Day Initiative as advisory ZDI-26-444.
• Root cause: a heap-based buffer overflow in 7-Zip's XZ-compressed data decoder; reported impact is arbitrary code execution in the context of the current user.
• 7-Zip has no auto-update mechanism, so the update must be downloaded and installed manually.

What was the actual flaw in 7-Zip?

The root cause was a heap-based buffer overflow in 7-Zip's decoder for XZ-compressed data. In plain terms: when unpacking a specially crafted archive, the decoder could write more data than the destination buffer had room for. Memory that was meant to hold decompressed output ends up receiving more bytes than it was sized for, and whatever sat next to it in the heap gets overwritten.

The reported impact is arbitrary code execution in the context of the current user. That last clause matters. It means any code that ran would have exactly the permissions of whoever opened the file - not administrator, not system, just that user's own access. Scoping impact precisely is how you avoid both under- and over-reacting.

Exploitation also requires user interaction. Someone has to open a crafted archive or visit a malicious site. This is not a flaw that reaches out and touches an idle machine.

How the fix works

The 26.02 source diff adds checks ensuring the decoder cannot write past the remaining available output-buffer space. That is the textbook remedy for this class of issue: before each write, confirm the amount of space actually left, and stop rather than continue if the requested write would exceed it.

It is a small change in line count and a large change in guarantee. Bounds checks at the write site turn an unbounded condition into a clean, predictable failure. If you want more on how this style of defensive coding is being scaled up, see our coverage of Capital One's VulnHunter open source AI security tool, which targets exactly these patterns.

Why is coordinated disclosure worth celebrating here?

Because every stage of it held. Landon Peng, working under the handle Lunbun, identified the issue and reported it rather than sitting on it. Trend Micro's Zero Day Initiative coordinated the handoff and tracked it as advisory ZDI-26-444, giving the maintainer a structured path and a clear technical writeup. The maintainer then shipped a targeted fix in 26.02.

The outcome speaks for itself: no in-the-wild exploitation was reported at the time of publication. Users are getting the patched build before anyone had to clean up an incident. That is the whole goal of coordinated disclosure, and it is genuinely satisfying to see the full chain land cleanly on a tool this widely deployed.

It also reflects a broader direction across the industry toward structured, proactive security work - the same posture we looked at in our piece on the Microsoft Secure Future Initiative in July 2026. More coverage of this kind lives in our AI security section.

What you should do right now

Here is the practical part, and it is the one detail that trips people up: 7-Zip has no auto-update mechanism. Nothing will prompt you. Nothing will patch itself in the background overnight. The update is entirely a manual step.

1. Check your installed version by opening 7-Zip and viewing the About dialog.
2. If you are below 26.02, download the current build directly from 7-zip.org - the official project site, not a mirror or a bundled installer.
3. Install over your existing copy, then confirm the version again.
4. If you manage machines for others, add 7-Zip to whatever inventory list you use for manually-updated software, since it will not show up in automatic patch reporting.

Until you are on 26.02, apply the usual habit: treat archives from unfamiliar senders as unopened until you have a reason to trust them. Then update, and move on. The researchers and maintainers already did the hard part.

Sources: BleepingComputer - July 18, 2026; Guru3D - July 18, 2026; 7-Zip project discussion - July 18, 2026.