Home / Technology / Urgent: Patch Your 7-Zip Now to Avoid Malware Attacks
Urgent: Patch Your 7-Zip Now to Avoid Malware Attacks
21 Jul
Summary
- A critical vulnerability in 7-Zip allows malware execution.
- The flaw stems from how 7-Zip processes XZ data.
- A June 25 update (version 26.02) patched this vulnerability.
Users of the popular free file-archiving software 7-Zip are urged to update immediately due to a critical security vulnerability. A flaw, uncovered by researcher Landon Peng, could allow attackers to execute malicious code on a user's computer. This exploit is triggered when 7-Zip processes a specially crafted XZ data compression format, leading to a buffer overflow error.
The vulnerability requires user interaction, meaning a target must open a malicious file or visit a booby-trapped website. Given 7-Zip's common use for handling compressed archives, malicious XZ files could be circulated online to distribute malware. 7-Zip has addressed this issue with an update released on June 25, version 26.02.
However, 7-Zip lacks an automatic update feature. This necessitates manual downloading and installation of the latest version for users to be protected. The software, available since 1999, has seen tens of millions of downloads, highlighting the broad potential impact of this vulnerability.
