WinRAR and 7-Zip users urged to manually update to fix critical vulnerabilities

Users of the widely adopted file archiving utilities WinRAR and 7-Zip are facing a sustained security challenge as attackers continue to weaponize vulnerabilities in both programs. Because neither tool includes an automated update mechanism, security researchers and infrastructure agencies are urging users to manually install the latest versions to mitigate risks ranging from denial-of-service crashes to full remote code execution.

Active exploitation of 7-Zip

7-Zip has become a high-priority target for threat actors, who frequently leverage its ubiquity across consumer and enterprise environments to gain system access. Multiple vulnerabilities have surfaced recently, requiring users to remain vigilant.

Related imagery

One primary concern is CVE-2025-11001, a remote code execution flaw that was flagged as actively exploited by NHS England Digital on Tuesday. This vulnerability, which affects versions prior to 25.00, allows attackers to execute arbitrary code when a victim interacts with a specially crafted archive.

Separately, a critical heap-based buffer overflow, CVE-2026-14266, affects how the software parses XZ-compressed data. Reported by Landon Peng of Lunbun, this flaw enables code execution if a user opens a malicious archive or visits a compromised website. As noted by Cyberpress, while the user interaction requirement makes this less than a zero-click exploit, the danger remains high given how often users handle downloaded archives. Another vulnerability, CVE-2025-53816, allows for denial-of-service attacks by triggering a crash in the RAR5 decoder. Discovered by Jaroslav Lobačevski of the GitHub Security Lab, this flaw demonstrates how attackers can disrupt automated file-processing systems.

WinRAR remains a target

WinRAR users face similarly persistent threats. Despite a patch being available for six months, security researchers report that CVE-2025-8088 continues to be exploited by a variety of actors, including state-sponsored groups and cybercriminals. The vulnerability allows attackers to create "booby-trapped" archives that load malicious code into a specific path on a Windows machine. According to Google security researchers, this flaw has been utilized since August and as recently as Jan. 22. Attackers are using the exploit to deliver remote access Trojans and password stealers, effectively bridging the gap between sophisticated espionage and financial crime. Because WinRAR lacks an auto-update feature, many systems remain vulnerable to these long-standing threats.

Ecosystem risks and spoofing

The danger is compounded by the prevalence of malicious lookalike websites. For instance, a deceptive site mimicking 7-Zip has been found distributing trojanized installers that turn residential PCs into proxy nodes. As detailed by Malwarebytes, this malware — detected as Trojan:Win32/Malgent!MSR — maintains system persistence by registering itself as a Windows service and modifying firewall rules to facilitate traffic routing through the victim's IP address. This campaign utilizes a modified build of 7zfm.exe alongside concealed components written to privileged system directories.

Furthermore, Tom's Hardware highlights that the threat landscape includes indirect risks, such as CI/CD workflows and automated server scripts that might process archives without human intervention. Because 7-Zip libraries are integrated into numerous third-party tools, an unpatched system could harbor exploitable code even if the primary application is not regularly opened. The risks extend to NTFS disk image processing within 7-Zip, where a bug allows an attacker to provide incorrect values for a buffer to facilitate code execution.

Summary of Required Actions

• 7-Zip: Users are urged to verify their version and update to at least 26.02 to cover recent remote code execution and heap-overflow risks.
• WinRAR: Users should manually download and install version 7.13 or newer to patch CVE-2025-8088.
• Verification: Ensure all downloads originate from official sources (such as 7-zip.org) to avoid proxyware and trojanized installers.
• Monitoring: Organizations should watch for anomalous processes, such as 7-Zip or WinRAR binaries being launched by unexpected system services, which may indicate compromise.