Endpoint Threat: High-Severity 7-Zip Vulnerability Enables Code Execution via Malicious XZ Archives

A high-severity memory corruption vulnerability has been uncovered within 7-Zip, the ubiquitous open-source archive manager deployed across millions of corporate endpoints and enterprise server installations. Disclosed through coordinated vulnerability channels with Trend Micro's Zero Day Initiative (ZDI), the flaw enables remote threat actors to achieve arbitrary code execution via specially crafted XZ compressed archives. Because file archiving utilities operate as trusted tools in daily workflows, this flaw represents an acute client-side attack vector.

The Ubiquity of 7-Zip and Client-Side Attack Surface

File archivers occupy an intimate layer of trust on enterprise endpoints. Users routinely open archives received via email, downloaded from corporate portals, or transferred across development networks without second thought. Operating systems commonly register archive tools as default handlers for dozens of file extensions, including .zip, .7z, .tar, and .xz.

Unlike modern web browsers that implement multi-process sandboxing, site isolation, and restrictive system call filters, legacy desktop utilities like 7-Zip traditionally run as single-process applications within the user's full security context. Consequently, any memory corruption vulnerability triggered during archive header parsing or block decompression provides an attacker with immediate code execution under the privileges of the logged-in user.

Technical Anatomy: Flawed Variable-Length Integer Decoding in XZ Streams

The XZ compression container specification relies on a modular stream architecture comprising stream headers, stream flags, variable-sized blocks, block headers, and stream footers. Numerical values inside block headers—such as uncompressed sizes, compressed sizes, and filter flags—are encoded as Variable-Length Integers (VLI) to conserve storage space.

The root vulnerability resides within the C-based XZ decoding module of 7-Zip (specifically within the XzDec.c and Lzma2Dec.c components). When parsing multi-stream containers with crafted block sizes, the decoder incorrectly calculates dynamic buffer allocations:

1. VLI Integer Truncation: An attacker crafts an XZ block header declaring an exceptionally large uncompressed data size using non-canonical VLI multibyte sequences. During size parsing, an integer truncation or sign-extension error occurs when casting the parsed 64-bit integer into a 32-bit allocation size parameter.
2. Undersized Heap Allocation: 7-Zip's memory manager calls malloc() or HeapAlloc(), allocating an undersized destination buffer based on the truncated 32-bit calculation.
3. Out-of-Bounds Heap Write: As the LZMA2 decompression state machine processes compressed dictionary blocks, it writes uncompressed byte streams beyond the physical boundaries of the allocated heap chunk.
4. Heap Metadata Overwrite & Execution Control: The out-of-bounds write overwrites adjacent heap control structures or C++ object virtual method tables (vftables). When 7-Zip attempts to free the buffer or call subsequent stream handling methods, execution flow diverts to an attacker-controlled Return-Oriented Programming (ROP) chain, bypassing Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR).

# Hex Dump Analysis of Malformed XZ Stream Header Triggering VLI Deserialization Flaw
00000000: fd37 7a58 5a00 0004 e6d6 b446 0200 2101  .7zXZ......F..!.
00000010: 1600 0000 742f e5a3 ffff ffff 7f00 0080  ....t/.......... <-- Manipulated VLI
00000020: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000030: 9090 9090 9090 9090 4141 4141 4141 4141  ........AAAAAAAA <-- ROP Staging Buffer

Exploit Delivery Mechanics: Phishing and MOTW Traversal

In real-world threat campaigns, attackers leverage archive formats to bypass corporate secure email gateways (SEG). Threat actors employ multi-layer packaging—such as nesting an ISO image containing a weaponized .xz file and an executable shortcut (LNK)—or delivering the .xz archive directly via encrypted cloud drive links.

On Windows platforms, files downloaded from external origins receive a Zone Identifier alternate data stream (Mark of the Web - MOTW). However, when third-party archivers extract archives without propagating MOTW metadata, extracted secondary payloads bypass Windows SmartScreen protections entirely, lowering security barriers for subsequent payload execution.

Heap Mitigations and YARA Inspection Rules

On modern Windows 11 and Windows Server 2025 systems, the default memory allocator is the Windows Segment Heap, which features advanced integrity checks, heap randomizations, and metadata encoding designed to resist classical NT Heap exploitation. However, by manipulating chunk sizes and orchestrating targeted heap grooming before the malformed VLI triggers, exploit writers can reliably overwrite adjacent C++ objects containing virtual method pointers.

To detect malicious XZ streams in transit across email gateways and network proxies, security teams can deploy the following YARA rule to flag non-canonical VLI multibyte lengths exceeding standard compression specifications:

rule Malicious_XZ_NonCanonical_VLI {
    meta:
        description = "Detects malformed XZ stream headers carrying non-canonical VLI byte sequences"
        author = "Cyber Threat Intelligence Research"
        date = "2026-08-10"
    strings:
        $xz_magic = { FD 37 7A 58 5A 00 }
        $vli_overflow = { FF FF FF FF 7F }
    condition:
        $xz_magic at 0 and $vli_overflow in (10..40)
}

Endpoint Telemetry and Threat Detection Signatures

Security operations centers must implement EDR detection rules monitoring 7-Zip process activities. Under normal operations, 7zFM.exe or 7zG.exe should never spawn command interpreters, scripting hosts, or dynamic network sockets:

# Hunting Anomalous 7-Zip Child Processes via Splunk
index=windows EventCode=1 (ParentImage="*\\7zFM.exe" OR ParentImage="*\\7zG.exe" OR ParentImage="*\\7z.exe")
Image IN ("*\\cmd.exe", "*\\powershell.exe", "*\\wscript.exe", "*\\cscript.exe", "*\\rundll32.exe", "*\\mshta.exe")
| stats count min(_time) as first_seen max(_time) as last_seen by ComputerName, User, ParentImage, Image, CommandLine

Remediation and Defensive Hardening Runbook

Organizations must adopt a comprehensive patch and mitigation strategy across desktop fleets and backend file processing nodes:

• Deploy 7-Zip Security Updates: Immediately update all 7-Zip installations across the fleet to version 24.08 or later, where Igor Pavlov implemented strict bounds verification on all VLI integer decoding functions and hardened heap allocation routines against arithmetic overflow.
• Automated Archive Ingestion Hardening: File upload portals, email attachments scanners, and malware sandbox pipelines that unpack archives automatically must execute 7-Zip within non-root container sandboxes or microVMs with strict memory allocation limits.
• Enforce Windows Exploit Guard Policies: Apply mandatory Exploit Protection policies via Group Policy (GPO) or Microsoft Intune to 7zFM.exe, 7zG.exe, and 7z.exe. Enforce Mandatory ASLR, Bottom-Up ASLR, and Strict Handle Checks.
• Block Untrusted XZ Extensions at Email Gateway: In environments where Linux source code distribution formats are not required for standard business operations, block incoming email attachments containing .xz, .txz, and .tar.xz extensions at the perimeter mail filter.