7-Zip Take-Over Flaws Fixed in 26.02: Affected Versions and How to Update

7-Zip, the free compression and extraction tool used around the world, carried more than one serious security flaw that could let an attacker take over a computer simply by getting the user to open a crafted file. CVE-2026-48095, in the code that reads NTFS images (CVSS v3.1 score 8.8, the second-highest of four bands, "High"), was fixed in version 26.01; CVE-2026-14266, in the code that extracts XZ archives (CVSS 7.0), was fixed in version 26.02. To close both at once, all you need is to be on 26.02 or later.

You can tell right away whether your copy is at risk. Launch 7-Zip, open "Help" → "About 7-Zip," and if it reads 26.01 or older, at least one of these flaws affects you (26.00 or older means both). The developer fixed CVE-2026-48095 in version 26.01 (April 27, 2026) and CVE-2026-14266 in version 26.02 (June 25, 2026), but 7-Zip has no automatic-update mechanism like a browser or a phone app, so unless you reinstall it yourself, an old build keeps running. The people most at risk are those who installed it once and left it untouched for years.

Proof-of-concept (PoC) exploit code for CVE-2026-48095 is already public, and outlets have been urging users to update. This article explains, in plain terms, what happens, why "it has a .zip extension so it must be safe" no longer holds, how hard the flaw is to exploit in practice, and what you should do on your own computer right now.

Which versions are affected, and how to update

If your 7-Zip is 26.01 or older, one of the flaws above affects you. Updating to the latest 26.02 or later closes both CVE-2026-48095 and CVE-2026-14266. You can check your version by launching 7-Zip and opening "Help" → "About 7-Zip" from the menu.

Always download the latest installer from the official 7-Zip site (7-zip.org) and install it over the top. As a rule, avoid search-ad links and unfamiliar mirror sites. You do not need to uninstall the old version first; running the new installer overwrites it. Note also that p7zip, used on Linux and macOS, and other software that bundles 7-Zip's code internally may carry the same flaw. Check the update notices from those distributors as well.

What happens: opening a crafted file can hand over your PC

The flaw lives in the code that 7-Zip uses to read a type of file called an NTFS image. NTFS is the disk format Windows uses, and an NTFS image packs the contents of such a disk into a single file. 7-Zip has a dedicated reader (the NTFS handler) so it can unpack these disk images too.

The trouble is that when an attacker feeds 7-Zip an NTFS image with tampered values, the program miscalculates how much memory to set aside. Where it should reserve a sufficiently large space (a buffer), the broken math reserves just a single byte. Up to 256 MB of attacker-supplied data is then written in, overflowing far past that one-byte slot and corrupting other parts of memory. This is a classic "heap buffer overflow," a common foothold for takeover.

CVE-2026-48095: a heap buffer overflow in NTFS image handling

The flaw is tracked as CVE-2026-48095. Technically it is a combination of an "integer overflow" (CWE-190) and an "out-of-bounds write" (CWE-787). It was found by Jaroslav Lobačevski of GitHub Security Lab.

According to the technical write-up, setting a specific parameter inside the NTFS image (the cluster-size value) to an abnormal size makes the multiplication used for memory allocation break down, collapsing the allocated size to one byte. As reading continues, important data in adjacent memory (a marker that tells the program which routine to call next) is overwritten, ultimately letting the attacker run code of their choosing, as security firms have analyzed. The hijacked code runs with the privileges of whoever is running that 7-Zip. In other words, if you open a file with your normal account, the attacker's code runs with your normal account too.

CVE-2026-14266: a heap buffer overflow when extracting XZ archives

After this article first went up, a second, similar flaw in a different spot was disclosed in 7-Zip. It is tracked as CVE-2026-14266, with a CVSS score of 7.0, and it lives in the code that extracts XZ-format archives. When an attacker feeds 7-Zip a crafted XZ archive, it triggers the same kind of heap buffer overflow — writing past the reserved slot and corrupting other memory — and, under the right conditions, can run code of the attacker's choosing. It affects versions 21.07 through 26.01 and was fixed in version 26.02, released June 25, 2026. Because the hole is still present in 26.01 — the version that fixed CVE-2026-48095 — even people who stopped at 26.01 need to move to 26.02. The Zero Day Initiative (ZDI), which brokers flaws to vendors, published the details as advisory ZDI-26-444 on July 15, 2026.

Who wants this bug, and what do they walk off with

What makes this flaw genuinely dangerous is that getting you to open a single file — with no password and no login required — is enough to start the attacker's program running inside that computer. The people who go after this are the senders of targeted emails that arrive disguised as files from a client or a job applicant, distributors who push pirated copies of popular software and videos, and fraud groups that send "quotes" or "outsourced materials". What they are after is whatever sits on that machine: work documents and customer lists, the IDs and passwords for various services, credentials saved in the browser, and crypto-wallet keys — the things that translate directly into cash or the next break-in. The moment a crafted archive is opened, the program that harvests all of this launches under your own account.

Once that program is running, the damage does not stop at one machine. With the stolen IDs and passwords, attackers move into shared servers and other endpoints, and ultimately use the foothold as an entry point to spread ransomware (malware that holds data hostage for money) across the whole organization. The lifted customer lists and credentials get resold on underground markets, and whoever buys them uses them for impersonation and the next round of phishing, pushing the damage further sideways. Because compressed files fly back and forth in everyday work, recipients tend to let their guard down — which is exactly what makes them an attractive entry point.

And the cleanup lands not on the individual who opened the file but, in most cases, on the company they belong to. If customer data leaks, there are breach notifications to the people affected and reports to regulators, plus apologies to business partners, damages, and the work of getting halted operations back on their feet. The CVSS "8.8" only describes the technical severity; what actually weighs on you are these real-world costs. That is why whether you can keep one free, casually installed tool up to date can decide whether you protect your company and its partners.

Why "it's a .zip, so it's fine" does not hold

A key thing to watch with this flaw is that the file used in the attack does not need an NTFS-image extension. It is tempting to think "I never open disk images, so this doesn't apply to me," but that does not protect you.

7-Zip judges a file's format not only by its extension but by the signature of its contents, and if it cannot open the file one way, it falls back to another reader. As a result, an attacker can disguise a file whose contents are a malicious NTFS image with an ordinary extension like ".7z," ".zip," or ".rar," and when the user opens it as usual, it ends up flowing into the flawed NTFS reader and triggers. In fact, security researchers abroad have warned that "a merely renamed file can trigger it" as well.

In short, the assumption that "the extension is .zip, so it must be an ordinary archive" no longer works. An unfamiliar archive attached to an email, a compressed file handed around on a forum or social media, or a download dressed up as a pirated copy is all it takes — extract it with an old 7-Zip and the conditions are met. The flip side is that not casually opening archives from untrusted sources is, alongside updating, an effective defense.

From discovery to disclosure

CVE-2026-48095 went from a private report to a fix and then to public exploit code. Later, a separate flaw in XZ-archive handling (CVE-2026-14266) surfaced and was patched in 26.02.

← Swipe to move

How hard is it to exploit, and how dangerous is it right now

There is no need to panic, but it is also dangerous to shrug off. For the flaw to be triggered, the user has to actually open (extract or test) a crafted file in 7-Zip. The CVSS breakdown notes "user interaction required (UI:R)," so this is not the kind that hijacks you while you do nothing. By contrast, it lacks the immediacy of an unauthenticated remote attack on factory software that lands a one-shot over the network; the attacker first needs a little effort to get you to "open it."

What you cannot dismiss, though, is that once you do open it, arbitrary code can run with no password or login, and that proof-of-concept (PoC) code is already public. 7-Zip is used widely, from individuals to enterprises, and exchanging archives over email and file sharing is routine. The raw materials for an attack are in place and users' guard is easy to slip — an attractive combination for attackers. Flaws in compress-and-extract handling keep turning up, as with the buffer overflow in IBM Aspera; the "open / extract a file" entry point is a recurring weak spot.

For the record, as of July 23, 2026 neither CVE-2026-48095 nor CVE-2026-14266 is listed in the CISA KEV catalog of "vulnerabilities known to be exploited," and months after disclosure no widespread abuse has been confirmed. But with the CVE-2026-48095 PoC in circulation, the bar for attackers to weaponize it has dropped. Closing it "before attacks spread" is the lowest-cost response.

Why "install once and forget" is the real danger

What makes 7-Zip awkward is not the quality of the software but the way it gets updated. Browsers and phone apps quietly swap themselves out for the latest version in the background, but 7-Zip has no auto-update. Unless users visit the official site themselves, download the latest version, and reinstall it, a build from years ago keeps running. It is the classic "install it once and forget it exists" tool, which is exactly why so many old versions linger.

On top of that, 7-Zip is free and lightweight, a staple extractor used widely by individuals and businesses alike. It is not unusual for it to run in places no one looks — on servers and NAS boxes, shared office machines, and automated batch jobs. Outlets urged users to update precisely because, with such a large user base, a great many old copies are presumed to be sitting untouched.

This pattern — "close at hand and widely used, yet last in line for updates" — is the same weakness seen in home network gear and smart-home devices. As with TP-Link's smart-home line and various routers, the most effective defense is to be aware that "even the staple tools I use need updates" and to make a habit of reviewing versions a few times a year.

What to do right now

What you need to do is basically a single update of 7-Zip. The steps are as follows.

• Launch 7-Zip and check your current version via "Help" → "About 7-Zip" in the menu
• If it is 26.01 or older, get the latest 26.02-or-later installer from the official download page and install it over the top
• Always download from the official site (7-zip.org); avoid search ads, unfamiliar mirrors, and bundle/aggregator sites
• If you use p7zip on Linux/macOS or software that bundles 7-Zip's code, check those distributors' update notices too
• Do not overlook 7-Zip running in out-of-sight places — servers, NAS boxes, and shared office machines

If you cannot update right away, the interim stopgap is to strictly not open archives from untrusted senders with an old 7-Zip. Because this attack hinges on "opening a crafted file," simply not extracting unexpected attachments or pirated/suspicious downloads cuts the risk substantially. As noted above, do not let your guard down just because the extension is .zip or .rar.

If you manage PCs at a company, the surest move is to inventory the deployed 7-Zip versions and roll out the update to the latest 26.02 or later in one go. Outlets have published concrete steps for checking and updating, which you can also use to brief your organization.

FAQ

Conclusion

7-Zip 26.00 and earlier, the staple compression and extraction tool, carried a serious flaw in its NTFS-image handling: CVE-2026-48095. When an attacker-crafted file is opened, a memory miscalculation causes a heap buffer overflow that can ultimately run arbitrary code on that computer. The fact that it can trigger via a file disguised with a .zip or .rar extension — not just an NTFS-image extension — is what makes the damage easy to spread. On top of that, 26.01, the version that fixed CVE-2026-48095, still carried a separate heap buffer overflow in XZ-archive handling (CVE-2026-14266).

Of these two, CVE-2026-48095 was fixed in 26.01 and CVE-2026-14266 in 26.02 — so being on the latest 26.02 or later closes both. Because 7-Zip has no auto-update, users must check their version themselves and update to the latest from the official site. As of July 23, 2026, no widespread abuse has been confirmed, but the CVE-2026-48095 proof-of-concept code is public. The longer you have left an old version installed, the more worthwhile it is to open "Help → About 7-Zip" now and check.

References

• ▸ NVD - CVE-2026-48095
• ▸ NVD - CVE-2026-14266 (heap buffer overflow in XZ archives)
• ▸ Zero Day Initiative - ZDI-26-444 (CVE-2026-14266)
• ▸ GitHub Security Lab - GHSL-2026-140: 7-Zip Heap Buffer Overflow
• ▸ 7-Zip Official - History (26.01 released April 27, 26.02 on June 25, 2026)
• ▸ 7-Zip Official Download Page
• ▸ SOC Prime - CVE-2026-48095: 7-Zip Heap Overflow Flaw
• ▸ TechSpot - New 7-Zip security flaw could put hundreds of millions of systems at risk
• ▸ CWE-787: Out-of-bounds Write
• ▸ CWE-190: Integer Overflow or Wraparound