7-Zip and PeaZip under the microscope: who builds them, how they work and what is inside

7-Zip sits on almost every corporate Windows machine. The IT department installs it “just in case”, half of the programs that need to unpack an update ship their own copy of it, and users reach for it whenever they want to “encrypt” files before sending them by e-mail. That is exactly why it is worth knowing where it comes from, how it is built and where its weak spots are — and what you actually get when you switch to PeaZip.

Who is behind 7-Zip

7-Zip was written, and has been developed from day one, by Igor Pavlov — a Russian programmer. The first release appeared in 1999 and for more than a quarter of a century the program has remained, in practice, a one-person project. There is no company behind it, no foundation, no team with divided responsibilities: the same person writes the code, handles bug reports, cuts releases and publishes them on 7-zip.org.

Several features of that model matter for security:

• The code is open, the process is not. Sources are published as archives alongside each release, under the GNU LGPL (with an extra restriction on the RAR decompression code, and some parts under a BSD licence). What is missing is a public repository with change history, code review and a list of people who approve patches. The 7-Zip repositories on GitHub are copies maintained by third parties.
• The LZMA engine is public domain. The LZMA SDK — the library with the LZMA/LZMA2 algorithms and 7z format support — has found its way into hundreds of other programs, installers and embedded systems. A bug in it therefore travels far beyond 7-Zip itself.
• A single point of trust. The security of millions of installations depends on the honesty, health and circumstances of one person in one jurisdiction. That is not an accusation against the author — nobody has shown a deliberate backdoor in 7-Zip — but it is precisely the kind of risk that supply-chain assessments are meant to catch.

How 7-Zip is built

Behind the plain window sits a fairly elaborate architecture. The program consists of several files that are easy to confuse:

The engine is written in C++ and C, and the hottest spots — the LZMA decoder, AES, CRC, SHA — have extra assembly versions for x86, x64 and ARM64. Inside, a COM-style plug-in system is at work: every archive format implements read and write interfaces (IInArchive, IOutArchive), and every algorithm implements a coder interface. Adding a new format therefore does not disturb the rest of the program.

The native 7z format is a container: a short signature header at the beginning, then the packed data streams, and at the end a header describing the files (often compressed itself). Files can be packed in solid mode — as one continuous stream — which gives an excellent compression ratio but means that a single damaged byte can destroy everything that follows it. The available methods are LZMA, LZMA2 (multi-threaded), PPMd, BZip2 and Deflate, plus filters that prepare machine code for compression (BCJ, BCJ2, ARM64).

The most important point from a security standpoint: 7-Zip creates a handful of formats (7z, ZIP, GZIP, BZIP2, XZ, TAR, WIM) but reads dozens — RAR, CAB, ISO, UDF, VHD/VHDX, NTFS and FAT images, HFS, SquashFS, MSI, CHM, NSIS installers and many more. Each of those parsers is code in a memory-unsafe language processing data supplied by a stranger. That is where most of the serious bugs have been found, not in LZMA itself.

How 7-Zip encrypts

• 7z archives: AES-256 in CBC mode. The key is derived from the password through 2¹⁹ (524,288) SHA-256 iterations with a salt. That slows password guessing down reasonably well, but it is not a modern GPU-resistant function such as Argon2.
• No authentication of the ciphertext. 7z has neither a MAC nor an AEAD mode. Integrity is checked with a CRC32 of the decompressed data — a checksum, not cryptographic proof that nothing has been altered.
• ZIP archives: the default method is the ancient ZipCrypto, broken by a known-plaintext attack (tools such as bkcrack do it in minutes if a fragment of even one file is known). AES-256 has to be chosen by hand.

Leaks: what an “encrypted” archive gives away

The most common leak involving 7-Zip needs no exploit at all. The default settings are enough:

1. File names stay in the clear. In a password-protected 7z archive the file list — names, sizes, modification dates — is visible without the password until “Encrypt file names” is ticked (on the command line: -mhe=on). A file called Audit_results_Smith_SSN.xlsx speaks for itself even if its contents are safe. In ZIP, file names cannot be encrypted at all.
2. ZIP with ZipCrypto. The user sees a “Password” field and assumes the data is protected. With ZipCrypto that protection is an illusion.
3. The password in the same channel. The archive as an attachment, the password in the next e-mail to the same mailbox — that is a procedural problem, not a program bug, but 7-Zip does nothing to make it harder.
4. Losing the “from the internet” mark. Windows tags downloaded files with the Mark-of-the-Web, which lets SmartScreen and Office warn before they are opened. For years 7-Zip did not carry that tag over to extracted files at all; since version 22.00 it can, but the option has to be switched on. The CVE-2025-0411 vulnerability made it possible to lose the tag even with the protection enabled — through an archive nested inside an archive.

A year later the same protective mechanism failed again, and more effectively. CVE-2026-58052 — reported by a researcher using the handle ashdfrkl through VulnCheck and published on 27 June 2026 — relies on a crafted RAR5 archive. 7-Zip suppressed an archive-supplied stream whose name was exactly Zone.Identifier, but a RAR5 record named :Zone.Identifier:$DATA slipped through that filter, and NTFS canonicalised both names to the same stream — overwriting the freshly applied Internet-zone marker with ZoneId=0. A second record, ::$DATA, replaced the extracted file’s actual contents. The result: no SmartScreen warning and a file showing something other than what its name promises. The NVD lists every version up to and including 26.01 as affected, and the fix only reached 26.03, released on 3 September 2026. A proof of concept is public.

The most important vulnerabilities of the past decade

The list below is not exhaustive, but it shows the pattern: the bugs live mostly in parsers for rarely used formats, and the result is often code execution triggered by merely opening an archive.

The bugs themselves are nothing unusual — every archiver has them. The problem is what happens after a fix is released:

• 7-Zip does not update itself. There is no update service and not even a notification about a new version. In a typical organisation every machine runs whatever version was current on the day the system was installed — sometimes years ago.
• Copies inside other programs. 7z.dll and 7za.exe live in the directories of dozens of applications and scripts. Updating the “main” 7-Zip does not touch them, and in practice nobody inventories such copies.
• No digital signature. The installers from 7-zip.org are not signed with an Authenticode certificate. You therefore cannot build an AppLocker/WDAC rule of the “allow this publisher” kind, and a user cannot tell the original from a forgery by its signature.
• Counterfeit sites. The only official address is 7-zip.org. Domains deceptively similar to it have repeatedly been used to distribute installers bundled with malware — and the missing digital signature makes such swaps easier.

PeaZip: what engine it really has

PeaZip is often named as “the alternative to 7-Zip”. It is built by Giorgio Tani from Italy, since 2006, in Free Pascal with the Lazarus environment, under the LGPLv3. It runs on Windows, Linux and macOS, has a more modern interface and built-in tools for checksums, secure file deletion and directory comparison.

Here is the key fact that few people know: PeaZip is largely a graphical front end. It handles only its own PEA format by itself; for all the other formats it calls external programs that it ships in its res\bin subdirectory:

• 7-Zip (7z.exe and 7z.dll; on Linux, 7-Zip for Linux or p7zip) — handling 7z, ZIP, TAR, GZ, XZ, ISO, CAB, RAR extraction and most of the remaining formats,
• Brotli and Zstandard — the reference tools for those algorithms,
• FreeArc, ZPAQ and the PAQ family — very high compression formats,
• UPX — executable packing.

In other words: when you create or open a 7z or ZIP archive in PeaZip, the work is done by exactly the same code as in 7-Zip. It inherits all of 7-Zip’s vulnerabilities — and receives fixes only once the PeaZip author ships a new version with a newer 7z.dll. What that means in practice is discussed below.

Where PeaZip genuinely differs

The PEA format is cryptographically better thought out than 7z — authenticated encryption detects any modification of the archive, not merely accidental damage. The catch is that practically only PeaZip can open a PEA archive, so any exchange of files with the outside world comes back to 7z or ZIP — that is, to 7-Zip underneath.

Why Polish public bodies moved away from 7-Zip

There is no single public regulation banning 7-Zip. Decisions are made in internal security policies, procurement requirements and lists of approved software — documents that are not published. Conversations with public-sector clients show, however, that the arguments repeat almost word for word:

1. The supplier’s origin. Since 2022 institutions have been looking far more closely at software built in Russia and Belarus, and the amendment to the Polish act on the national cybersecurity system provides for a mechanism to designate high-risk suppliers. A one-person project in Russia, without a company to sign a contract with and without any way to audit the release process, does not pass that assessment — regardless of the quality of the code itself.
2. Real attacks through archivers. CVE-2025-0411 was used against state institutions in a neighbouring country. For Polish services that is not an abstraction but a description of an attack that may reach them tomorrow.
3. No control over versions. A program without an update mechanism and without a digital signature is hard to deploy centrally, hard to keep track of and hard to protect against forgeries with AppLocker/WDAC rules.
4. The cryptography does not meet the requirements. AES-CBC without authentication, file names in the clear by default and ZipCrypto in ZIP make up a set that will not pass review. For classified information an archiver is unsuitable in any case: protecting it requires cryptographic means certified by the Polish ABW or SKW.
5. Supply chain and SBOM. Contracting authorities increasingly demand a bill of software components. 7-Zip pasted into ten products in ten different versions is an entry nobody wants to explain to an auditor.

The replacement most often chosen is PeaZip. From the point of view of such a policy that is a logical pick: an author inside the European Union, an actively maintained GitHub repository, predictable releases and a native format with decent authenticated encryption. The institution gets a supplier it can describe in its documentation.

It is worth knowing what comes with it, though. For 7z and ZIP the work is still done by the 7-Zip engine bundled with PeaZip, so the parser vulnerabilities remain — what changes is who ships the fix, and when. With PeaZip, therefore, two things deserve attention: keeping the program up to date (because the embedded 7z.dll is updated along with it) and listing what sits in its res\bin subdirectory during software inventories. Full independence from 7-Zip code only comes with the PEA format — which, at the recipient’s end, only PeaZip will open.

What to do in practice

If 7-Zip has to stay in the organisation for now:

• download it only from 7-zip.org and keep at least version 26.03 of 3 September 2026 — it fixes the most recent Mark-of-the-Web bypass, and every older one has known, publicly described vulnerabilities,
• deploy it centrally and hunt for orphaned copies of 7z.dll, 7za.exe and 7zr.exe in other programs’ directories,
• when encrypting, always use the 7z format with file-name encryption enabled (-mhe=on); if it has to be ZIP — AES-256 only, never ZipCrypto,
• in the settings (Tools → Options → 7-Zip) enable propagation of the Zone.Identifier stream to extracted files,
• send the password through a different channel than the archive itself — by phone or text message.

For simply extracting ordinary archives, Windows 11 is enough these days: since the autumn 2023 update, File Explorer opens 7z, RAR and TAR through the built-in libarchive library, with nothing to install.

Sources

• The official 7-Zip site and change history: 7-zip.org, 7-zip.org/history.txt, licence: 7-zip.org/license.txt
• LZMA SDK: 7-zip.org/sdk.html
• PeaZip: peazip.github.io
• Vulnerability records in the NVD: CVE-2026-58052, CVE-2025-0411, CVE-2025-11001, CVE-2025-55188, CVE-2024-11477, CVE-2018-10115
• Write-up of the RAR5 Mark-of-the-Web flaw: VulnCheck advisory