The latest version of the classic open-source decompression software “7-Zip,” v26.02, was officially released on June 25, 2026. This update is positioned as a significant minor update aimed at fixing previously discovered serious vulnerabilities and bugs.

Significance of the official release and update on June 25, 2026

The latest version v26.02 of the widely used open-source extraction and compression software “7-Zip” was released on June 25, 2026. This update follows v26.01, released in April 2026, and developer Igor Pavlov has announced several bug and vulnerability fixes. 7-Zip supports a wide range of archive formats such as ZIP, GZIP, RAR, and LZH, boasting high compression rates using the LZMA/LZMA2 algorithm, as well as a wide range of archive formats including ZIP, GZIP, RAR, and LZH. Due to its convenience and open-source status (GNU LGPL license), it has been downloaded over hundreds of millions of times and is a very popular tool.

The method to check the latest update status is shown in the diagram below.

Check the version information from the Help menu, and if you are using versions prior to v26.02, it is recommended to immediately download and apply the latest version from the official website or a trusted library. Especially since it supports a wide range from Windows 2000 to the latest Windows 11, updates are possible even in environments with older operating systems.

The risk of ‘post-facto reports’ where the details of corrections are withheld

In the release notes for version 26.02, the specific details of the vulnerability were not fully disclosed from the start. This is not uncommon in 7-Zip’s development, and previous cases have repeatedly seen serious vulnerabilities such as heap buffer overflows being disclosed by security agencies some time after the release of the fix. For example, the critical vulnerability “CVE-2026-48095,” which recorded a CVSS score of 8.8, was reported on April 24, 2026, and fixed in v26.01 just three days later on April 27, but detailed analysis results were only widely released later by GitHub Security Lab and other platforms.

Thus, the reason updates are distributed before the full details of the fix is to withhold information from attackers, while also requiring users to respond quickly so that they do not decide to postpone updates because the details are unknown. Based on past lessons, announcements about “bug and vulnerability fixes” in 7-Zip are likely to carry critical risks such as arbitrary code execution.

Analysis of Serious Vulnerabilities Previously Exposed

Heap buffer overflow that leads to arbitrary code execution

In the history of 7-Zip, the vulnerability “CVE-2026-48095,” discovered in 2026, is one of the most noteworthy vulnerabilities. This vulnerability is a heap buffer overflow caused by a function inside the “NtfsHandler.cpp” that processes NTFS format archives, and occurs when memory is not properly allocated when processing crafted NTFS images. Specifically, they exploited a bug where only one byte was allocated for a buffer normally required of 256MB, allowing attackers to write the intended data, which in the worst case could result in arbitrary code execution on the computer.

The frightening aspect of this vulnerability is that it can manifest simply by “opening” the file with 7-Zip without actually “exporting” the contents of the archive. Also, 7-Zip determines the format by looking at the first few bytes (signature) of the file rather than the file extension, so it looks like “.7z” or “. Even if it is a zip,” if it contains a fabricated NTFS image inside, it becomes a vulnerability.

The reality of MoTW evasive attacks targeting Ukraine

Looking further back from 2024 to 2025, actual cyberattacks exploiting vulnerabilities in 7-Zip have also been confirmed. The vulnerability “CVE-2025-0411” bypassed Windows’ security feature “Mark-of-the-Web (MoTW).” Normally, files downloaded from the internet are marked with the “Zone.Identifier” mark, and the OS issues warnings during execution, but when handling files archived twice with 7-Zip, this protection does not propagate, resulting in malicious programs executing without warning.

This flaw was actually exploited in a campaign by a Russian cybercriminal group with the “SmokeLoader” malware, which targeted Ukrainian government agencies and companies. Attackers combined a technique called a “homoglyph attack,” creating fake extensions (e.g., ○○.doс) using the Cyrillic letter “с” similar to the ASCII letter “C,” tricking users into mistaking them for document files and executing malicious scripts.

The diagram below shows the difference in how legitimate and disguised files look.

Thus, 7-Zip has a history of being used not only as a vulnerability as a tool but also as a tool for cyberattacks in interstate conflicts.

Future developments and required user defense measures

Lack of automatic updates and management cost challenges

The biggest challenge in 7-Zip’s security management is that this software does not include an “automatic update feature.” While many modern applications check and update the latest version in the background, 7-Zip requires users to manually check the official site and run the installer to overwrite and save it. This specification makes it easier for older versions to be left unattended, putting millions or even hundreds of millions of users at risk of remaining vulnerable.

In corporate environments, it is essential for IT departments to use management tools to simultaneously check all PC versions and enforce updates through organizational measures. On the other hand, derivative software like “NanaZip,” based on 7-Zip’s source code, supports integration with Windows 11’s modern UI and automatic updates via the Microsoft Store, making it a strong alternative to reduce management effort. Users are now at a time to select the right tools according to their management capabilities.

The role of the new open source protection framework “Akrites”

Vulnerabilities in widely used open source software (OSS) like 7-Zip are being discovered and exploited at unprecedented speed thanks to advances in AI technology. To counter this situation, the Linux Foundation launched a new security framework called “Akrites” on June 26, 2026. This initiative includes major companies such as Microsoft, Google, Amazon Web Services (AWS), and OpenAI, helping to accelerate the process from vulnerability discovery to fixing and publication in critical OSS projects.

Initiatives like Akrites are expected to enable AI-powered vulnerability assessments and rapid patch delivery even for projects maintained by small teams like 7-Zip. However, no matter how quickly developers provide fixes, it is ultimately the end users themselves who adopt them. Updating to the latest version 26.02 is not just a feature addition, but an essential ritual to protect your data from ever-evolving cyber threats.

[#7Zip #脆弱性 #サイバーセキュリティ #オープンソース #ITニュース #Windows #アップデート]