A security vulnerability in 7-Zip allows a remote, unauthenticated attacker to execute arbitrary code. The flaw is a heap-based buffer overflow triggered during the processing of XZ-chunked data. Exploitation requires user interaction: the victim must open a specially crafted archive file.
Heap-based buffer overflows occur when a program writes more data into a memory region than allocated, overflowing into adjacent memory areas. Attackers typically exploit such flaws to inject and execute code within the process memory space.
7-Zip is one of the most widely used file archivers, installed on millions of Windows systems. Users should update to the latest version immediately. Those who don't strictly need 7-Zip should also consider whether automatic opening of archive files from unknown sources can be restricted via security policies.