What changed in 7-Zip from 25 to 26

4 releases numbered after 25.01 up to and including 26.03, stable releases only. 25.01 and 26.03 are the newest stable releases of 25 and 26 we track; this page follows them as new ones ship.

19 changes across 4 releases

Added 1

26.01

  • Add `-spo[d|c|r]` switch to specify the path generation mode for the output directory for archive extraction
Changed 5

26.03

  • Improved support for Joliet ISO images and Compound archives

26.01

  • Linux version of 7-Zip can use huge pages (2 MB pages) to increase compression speed for 10% for 7z/xz/LZMA/LZMA2 compression

26.00

  • Improved code for ZIP, CPIO, RAR, UFD, QCOW, Compound formats
  • 7-Zip File Manager improved sorting order of the file list to use file name as secondary sorting key
  • 7-Zip File Manager Benchmark improved to support systems with more than 64 CPU threads
Fixed 11

26.03

  • Fixed some bugs and vulnerabilities

26.02

  • Fixed bugs and vulnerabilities

26.01

  • Fix heap memory disclosure via SquashFS fragment offset integer overflow on 32-bit builds (CVE-2026-48092)
  • Fix heap buffer overflow in the NTFS archive handler (CVE-2026-48095)
  • Fix uninitialized memory disclosure vulnerability in the UEFI archive handler (CVE-2026-48101)
  • Fix heap out-of-bounds read in the UDF archive handler (CVE-2026-48102)
  • Fix heap out-of-bounds read in the WIM archive handler (CVE-2026-48103)
  • Fix uninitialized heap read in the SquashFS archive handler (CVE-2026-48104)
  • Fix out-of-bounds read vulnerability in UEFI archive handler (CVE-2026-48111)
  • Fix heap out-of-bounds read in 7-Zip Ar archive handler (CVE-2026-48112)

26.00

  • Fixed bug where 7-Zip could not correctly extract TAR archives containing sparse files
Security 2

26.03

  • Fixed CVE-2026-58052 where 7-Zip failed to preserve the Mark-of-the-Web when extracting a crafted archive

26.02

  • Fixed CVE-2026-14266: XZ Decompression Heap-based Buffer Overflow Remote Code Execution

Original release notes, newest first

The list above is our reading of these notes; the originals from Igor Pavlov are here, one fold per release.

26.037-Zip 26.03
  • Improved support for Joliet ISO images and Compound archives.
  • Some bugs and vulnerabilities were fixed.
  • CVE-2026-58052 : 7-Zip failed to preserve the Mark-of-the-Web when extracting a crafted archive.

View originalPermalink

26.027-Zip 26.02
  • Some bugs and vulnerabilities were fixed.
  • CVE-2026-14266 : XZ Decompression Heap-based Buffer Overflow Remote Code Execution.

View originalPermalink

26.017-Zip 26.01
  • linux version of 7-Zip can use huge pages (2 MB pages). It can increase compression speed for 10% for 7z/xz/LZMA/LZMA2 compression.
  • new -spo[d|c|r] switch specifies the path generation mode for the output directory for archive extraction. The output directory path is generated from the path specified in the -o{dir_path} switch and the name of the archive being unpacked. -spod : for Linux/Posix/macOS: -o{dir_path} specifies the direct path to the output directory. The asterisk (*) character in {dir_path} will not be replaced by the archive name. -spoc : 7-Zip will concatenate the path specified in -o{dir_path} with the archive name to form the final path to the output directory. -spor : 7-Zip will replace asterisk (*) character in the path specified in the -o{dir_path} with the archive name. This is the default option.
  • some bugs were fixed.
  • CVE-2026-48092 : A heap memory disclosure via SquashFS fragment offset integer overflow on 32-bit builds.
  • CVE-2026-48095 : A heap buffer overflow in the NTFS archive handler.
  • CVE-2026-48101 : An uninitialized memory disclosure vulnerability in the UEFI archive handler.
  • CVE-2026-48102 : A heap out-of-bounds read in the UDF archive handler.
  • CVE-2026-48103 : A heap out-of-bounds read in the WIM archive handler.
  • CVE-2026-48104 : An uninitialized heap read in the SquashFS archive handler.
  • CVE-2026-48111 : An out-of-bounds read vulnerability UEFI archive handler.
  • CVE-2026-48112 : A heap out-of-bounds read in 7-Zip Ar archive handler.

View originalPermalink

26.00
7-Zip 26.00
  • improved code for ZIP, CPIO, RAR, UFD, QCOW, Compound.
  • 7-Zip File Manager: improved sorting order of the file list. It uses file name as secondary sorting key.
  • 7-Zip File Manager: improved Benchmark to support systems with more than 64 CPU threads.
  • the bug was fixed: 7-Zip could not correctly extract TAR archives containing sparse files.
  • some bugs were fixed.

View originalPermalink