# 7-Zip: what changed from 25 to 26

- Product: 7-Zip (https://whatsnew.fyi/product/7-zip)
- Vendor: Igor Pavlov
- Range: changelog entries numbered after 25.01 up to and including 26.03, stable releases only
- Entries below: 4 releases (newest first)
- Resolved: 25 is 25.01 and 26 is 26.03, the newest stable release of each major we track
- Carrying security changes: 2 · CVEs mentioned: 10 · Mentioning breaking changes: 0 · Removing or deprecating something: 0
- Page: https://whatsnew.fyi/product/7-zip/compare/25...26

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## What changed (19 changes, grouped by kind)

### Added

#### 26.01 (2026-04-27)

- Add `-spo[d|c|r]` switch to specify the path generation mode for the output directory for archive extraction

### Changed

#### 26.03 (2026-09-04)

- Improved support for Joliet ISO images and Compound archives

#### 26.01 (2026-04-27)

- Linux version of 7-Zip can use huge pages (2 MB pages) to increase compression speed for 10% for 7z/xz/LZMA/LZMA2 compression

#### 26.00 (2026-02-12)

- Improved code for ZIP, CPIO, RAR, UFD, QCOW, Compound formats
- 7-Zip File Manager improved sorting order of the file list to use file name as secondary sorting key
- 7-Zip File Manager Benchmark improved to support systems with more than 64 CPU threads

### Fixed

#### 26.03 (2026-09-04)

- Fixed some bugs and vulnerabilities

#### 26.02 (2026-06-26)

- Fixed bugs and vulnerabilities

#### 26.01 (2026-04-27)

- Fix heap memory disclosure via SquashFS fragment offset integer overflow on 32-bit builds (CVE-2026-48092)
- Fix heap buffer overflow in the NTFS archive handler (CVE-2026-48095)
- Fix uninitialized memory disclosure vulnerability in the UEFI archive handler (CVE-2026-48101)
- Fix heap out-of-bounds read in the UDF archive handler (CVE-2026-48102)
- Fix heap out-of-bounds read in the WIM archive handler (CVE-2026-48103)
- Fix uninitialized heap read in the SquashFS archive handler (CVE-2026-48104)
- Fix out-of-bounds read vulnerability in UEFI archive handler (CVE-2026-48111)
- Fix heap out-of-bounds read in 7-Zip Ar archive handler (CVE-2026-48112)

#### 26.00 (2026-02-12)

- Fixed bug where 7-Zip could not correctly extract TAR archives containing sparse files

### Security

#### 26.03 (2026-09-04)

- Fixed CVE-2026-58052 where 7-Zip failed to preserve the Mark-of-the-Web when extracting a crafted archive

#### 26.02 (2026-06-26)

- Fixed CVE-2026-14266: XZ Decompression Heap-based Buffer Overflow Remote Code Execution

## Release notes

### 26.03 — 7-Zip 26.03

- Date: 2026-09-04
- Version: 26.03
- Original notes: https://github.com/ip7z/7zip/releases/tag/26.03
- Permalink: https://whatsnew.fyi/product/7-zip/releases/26.03
- Labels: Platforms: Desktop

- **changed** — Improved support for Joliet ISO images and Compound archives
- **security** — Fixed CVE-2026-58052 where 7-Zip failed to preserve the Mark-of-the-Web when extracting a crafted archive
- **fixed** — Fixed some bugs and vulnerabilities

###### 7-Zip 26.03
- Improved support for Joliet ISO images and Compound archives.
- Some bugs and vulnerabilities were fixed.
- CVE-2026-58052 : 7-Zip failed to preserve the Mark-of-the-Web when extracting a crafted archive.

### 26.02 — 7-Zip 26.02

- Date: 2026-06-26
- Version: 26.02
- Original notes: https://github.com/ip7z/7zip/releases/tag/26.02
- Permalink: https://whatsnew.fyi/product/7-zip/releases/26.02
- Labels: Platforms: Desktop

- **fixed** — Fixed bugs and vulnerabilities
- **security** — Fixed CVE-2026-14266: XZ Decompression Heap-based Buffer Overflow Remote Code Execution

###### 7-Zip 26.02
- Some bugs and vulnerabilities were fixed.
- CVE-2026-14266 : XZ Decompression Heap-based Buffer Overflow Remote Code Execution.

### 26.01 — 7-Zip 26.01

- Date: 2026-04-27
- Version: 26.01
- Original notes: https://github.com/ip7z/7zip/releases/tag/26.01
- Permalink: https://whatsnew.fyi/product/7-zip/releases/26.01
- Labels: Platforms: Desktop

- **changed** — Linux version of 7-Zip can use huge pages (2 MB pages) to increase compression speed for 10% for 7z/xz/LZMA/LZMA2 compression
- **added** — Add `-spo[d|c|r]` switch to specify the path generation mode for the output directory for archive extraction
- **fixed** — Fix heap memory disclosure via SquashFS fragment offset integer overflow on 32-bit builds (CVE-2026-48092)
- **fixed** — Fix heap buffer overflow in the NTFS archive handler (CVE-2026-48095)
- **fixed** — Fix uninitialized memory disclosure vulnerability in the UEFI archive handler (CVE-2026-48101)
- **fixed** — Fix heap out-of-bounds read in the UDF archive handler (CVE-2026-48102)
- **fixed** — Fix heap out-of-bounds read in the WIM archive handler (CVE-2026-48103)
- **fixed** — Fix uninitialized heap read in the SquashFS archive handler (CVE-2026-48104)
- **fixed** — Fix out-of-bounds read vulnerability in UEFI archive handler (CVE-2026-48111)
- **fixed** — Fix heap out-of-bounds read in 7-Zip Ar archive handler (CVE-2026-48112)

###### 7-Zip 26.01
- linux version of 7-Zip can use huge pages (2 MB pages). It can increase compression speed for 10% for 7z/xz/LZMA/LZMA2 compression.
- new `-spo[d|c|r]` switch specifies the path generation mode for the output directory for archive extraction. The output directory path is generated from the path specified in the `-o{dir_path}` switch and the name of the archive being unpacked.
    `-spod` : for Linux/Posix/macOS: `-o{dir_path}` specifies the direct path to the output directory. The asterisk (`*`) character in {dir_path} will not be replaced by the archive name.
    `-spoc` : 7-Zip will concatenate the path specified in `-o{dir_path}` with the archive name to form the final path to the output directory.
    `-spor` : 7-Zip will replace asterisk (`*`) character in the path specified in the `-o{dir_path}` with the archive name. This is the default option.
- some bugs were fixed.
- CVE-2026-48092 : A heap memory disclosure via SquashFS fragment offset integer overflow on 32-bit builds.
- CVE-2026-48095 : A heap buffer overflow in the NTFS archive handler.
- CVE-2026-48101 : An uninitialized memory disclosure vulnerability in the UEFI archive handler.
- CVE-2026-48102 : A heap out-of-bounds read in the UDF archive handler.
- CVE-2026-48103 : A heap out-of-bounds read in the WIM archive handler.
- CVE-2026-48104 : An uninitialized heap read in the SquashFS archive handler.
- CVE-2026-48111 : An out-of-bounds read vulnerability UEFI archive handler.
- CVE-2026-48112 : A heap out-of-bounds read in 7-Zip Ar archive handler.

### 26.00

- Date: 2026-02-12
- Version: 26.00
- Original notes: https://github.com/ip7z/7zip/releases/tag/26.00
- Permalink: https://whatsnew.fyi/product/7-zip/releases/26.00
- Labels: Platforms: Desktop

- **changed** — Improved code for ZIP, CPIO, RAR, UFD, QCOW, Compound formats
- **changed** — 7-Zip File Manager improved sorting order of the file list to use file name as secondary sorting key
- **changed** — 7-Zip File Manager Benchmark improved to support systems with more than 64 CPU threads
- **fixed** — Fixed bug where 7-Zip could not correctly extract TAR archives containing sparse files

###### 7-Zip 26.00
- improved code for ZIP, CPIO, RAR, UFD, QCOW, Compound.
- 7-Zip File Manager: improved sorting order of the file list. It uses file name as secondary sorting key.
- 7-Zip File Manager: improved Benchmark to support systems with more than 64 CPU threads.
- the bug was fixed: 7-Zip could not correctly extract TAR archives containing sparse files.
- some bugs were fixed.