A vulnerability has been found in 7-Zip that allows a remote, anonymous attacker to execute arbitrary code. The cause is a heap-based buffer overflow during the processing of XZ-chunked data. Successful exploitation requires a user action: the victim must open a specially crafted archive file.
7-Zip is one of the most widely used free archiving programs and is installed on many Windows systems. XZ is a compression format that 7-Zip handles natively. When malformed XZ data is processed during extraction, it can trigger a buffer overflow that gives an attacker control over program execution.
What to Do
Update 7-Zip to the latest available version. Avoid opening archive files from unknown sources, even if they appear harmless. You can download the update from the official 7-Zip website.