Proper 7-Zip 26.02 changelog

Proper_7-Zip_26.02_changelog.md

7-Zip 26.02

Released 2026-06-25

7-Zip 26.02 hardens archive parsing, closes several malformed-input and oversized-allocation paths, and fixes compatibility issues in XZ, NSIS, filesystem-image, and UI code.

Security and robustness

• Hardened the C and C++ 7z readers against malformed headers. The readers now reject duplicate or contradictory metadata blocks, validate each property within its declared size, verify external-stream references, and require metadata payloads to be consumed exactly.
• Added overflow and range checks for pack positions, coder and substream counts, unpack-size arrays, next-header offsets, and next-header sizes. Empty next headers must now have a zero offset and CRC.
• Disabled split-entry writes during normal filesystem extraction. Entries carrying an explicit output position are reported as unsupported instead of opening an output file and writing at the supplied offset.
• Added allocation limits and deterministic initialization for File Manager proxy lists and FAR panel items, including safe cleanup after partially completed archive loads.
• Added input limits for extreme archive filenames and EXT filesystem inode tables, and fixed an out-of-range access in the LVM property handler.

Archive and decoder fixes

• Fixed output-buffer accounting in the XZ multi-coder decoder, including an underflow check when resuming buffered output.
• Improved 7z substream validation: duplicate count or CRC records, count overflows, inconsistent unpack-size totals, and trailing property data are now rejected.
• Fixed NSIS 3.10 command parsing for the four-parameter SetDetailsPrint form and its special lastused value.
• Accepted all-zero CHS fields in otherwise valid MBR partition entries.
• Corrected APFS inode and parent-inode property types, and corrected the declared type of the alternate-stream count property.

File Manager and plugins

• Made archive proxy allocation reject impractically large item counts before array allocation, zero-initialize new entries, and release owned filenames safely after errors or reloads.
• Made the FAR plugin initialize its output parameters, propagate item-count failures, reject oversized item lists, and zero-initialize panel records.
• Fixed explicit initialization of update, browse-dialog, PE, HFS, NTFS, SquashFS, Android sparse-image, logical-partition, and WIM records.
• Simplified external-codec registry-path selection without changing its search order or loading behavior.
• Removed unused FAR registry-query helper implementations.

Build and source maintenance

• Renamed CPP/Windows/Defs.h to CPP/Windows/WinDefs.h and updated active source includes to avoid ambiguity with CPP/Common/Defs.h.
• Added compatibility for Clang 22's -Wshadow-header diagnostic.
• Tightened the legacy 32-bit MSVC array-allocation limit to leave room for array bookkeeping.
• Normalized Windows string declarations from wchar_t to WCHAR in the installer, uninstaller, SFX setup, and DLL-security helper. This does not change their runtime behavior.
• Updated version, WiX, README, and source-history metadata to 26.02.

Component scope notes

• The installer and uninstaller contain no new install, registry, privilege, process-launch, or removal behavior in this release.
• WIM writing changes are explicit-initialization maintenance; the WIM archive format and compression logic are unchanged.
• The 7z writer changes are explicit-initialization maintenance. The substantive 7z changes are in archive reading and validation.
• The NSIS handler parses installer data for listing and extraction; the changed code does not execute NSIS instructions.
• No new networking, process-execution, shell-execution, or dynamic-loader calls were added by this source diff.

Known source-package issue

Seven legacy Visual C++ .dsp project files still reference the old CPP/Windows/Defs.h path after the file was renamed to WinDefs.h. The active makefile-based builds use the updated includes, but those legacy project entries should be corrected.

Source-diff summary

• 63 logical files changed: 62 files modified and one header renamed.
• 729 lines added and 639 lines removed.
• Both source packages contain 1,292 files; no new source or binary payload was added.
• Most line churn comes from the C 7z-reader hardening and mechanical explicit-initialization changes.

Security identifiers and exploitability details were not included in the supplied source or release notes, so this changelog describes observable code changes without assigning CVE numbers or claiming specific exploit primitives.