Released 2026-06-25
7-Zip 26.02 hardens archive parsing, closes several malformed-input and oversized-allocation paths, and fixes compatibility issues in XZ, NSIS, filesystem-image, and UI code.
- Hardened the C and C++ 7z readers against malformed headers. The readers now reject duplicate or contradictory metadata blocks, validate each property within its declared size, verify external-stream references, and require metadata payloads to be consumed exactly.
- Added overflow and range checks for pack positions, coder and substream counts, unpack-size arrays, next-header offsets, and next-header sizes. Empty next headers must now have a zero offset and CRC.