Update now: 7-Zip fixes RCE flaw exploitable with malicious archives

7-Zip released version 26.02 to fix a heap-based buffer overflow in its XZ decompression that could enable arbitrary code execution when a user opens specially crafted compressed files; the patch adds bounds checks to prevent writes beyond available output buffer space. Exploitation requires user interaction (e.g., opening a malicious archive or visiting a page) and there are no reports of active exploitation, so users must update manually because 7-Zip lacks automatic updates.