A heap‑based buffer overflow exists in the way 7‑Zip processes XZ chunked data. When a specially crafted XZ file is decompressed, the overflow can be triggered and the attacker can execute code with the privileges of the 7‑Zip process. This leads to remote code execution, the highest impact class for a local application, as it can compromise the entire system if the user runs the program. The weakness is identified as CWE‑122, a classic heap corruption vulnerability.

All installations of 7‑Zip are potentially affected, regardless of version, because the CVE provides no version restriction. The flaw is present in the XZ decompression component of the program, so any machine that uses 7‑Zip to extract XZ or other files bundled with XZ‑encoded chunks is at risk.

The CVSS score of 7.8 classifies the issue as high severity, but the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability requires user interaction – the victim must intentionally open a malicious file or visit a malicious web page that triggers a download. KEV lists do not include this CVE, so an active exploit is not widely confirmed. Nonetheless, in environments where users download and decompress files from untrusted sources, the risk is considerable because an attacker can obtain arbitrary code execution as the 7‑Zip process runs under the current user context.