7-Zip patches critical vulnerability allowing arbitrary code execution

The developers of the popular 7-Zip archiver have released an update that fixes a vulnerability allowing attackers to execute arbitrary code on a victim's computer.

What the problem is

The vulnerability can be exploited using a specially crafted archive. For an attack to succeed, all that's needed is for the user to open such a file — a common vector that cybercriminals often resort to, disguising malicious archives as harmless documents or images.

Successful exploitation of the vulnerability allows arbitrary code to be executed on the victim's device, which makes it potentially dangerous for a wide range of users who regularly work with archives from external sources.

The fix

The issue has been resolved in 7-Zip version 26.02. The developers strongly recommend that all users update the application to the current version as soon as possible in order to eliminate the risk of attack.

7-Zip remains one of the most widely used free archivers and is deployed in both private and corporate environments, so a prompt update is especially important for organizations where the application is used on a large scale.

Source: Bleeping Computer