7-Zip ZS 26.01 - v1.5.7 - Release 1
Security updates:
- GHSL-2026-135, Use-after-free in Lizard/LZ4/LZ5 (@JarLob)
- GHSL-2026-136, Stack buffer overflow in Lizard Huffman weight decoder (@JarLob)
- GHSL-2026-137, Heap OOB read in SetDecoderProperties2 via undersized codec properties buffer (@JarLob)
- GHSL-2026-138, Heap OOB read in SquashFS LZ4 decompressor (@JarLob)
- GHSL-2026-139, Heap OOB read in pt_decompress (@JarLob)
Compression versions in this release:
- Brotli Version 1.2.0
- Fast LZMA2 1.0.1
- Lizard Version 2.1
- LZ4 Version 1.10
- LZ5 Version 1.5
- Zstandard Version 1.5.7
Non-darkmode binaries (with -ndm suffix) are provided to support 5.0 subsystem (Windows 7), see gh-440.
What's Changed
- Fix issue with tree views in classic mode using wrong style by @ozone10 in #453
- GHA-CI: ARM runner for windows, flow optimization and deduplication by @sebres in #455
- Revert zst icon to modern one by @adem4ik in #457
- Fix the build of Clang 21.1.8. by @peashooter2 in #460
- Update: merged mainline v.26.00 by @sebres in #468
- Add zstd decompression support for NSIS archives by @hshakula in #475
- update CI: node.js 24, windows 2025 with vs2026 by @sebres in #489
- Merge 7-Zip 26.01 sources into 7-Zip-zstd by @boumenot in #491
- Update darkmodelib to 0.64.0 by @ozone10 in #502
New Contributors
- @adem4ik made their first contribution in #457
- @peashooter2 made their first contribution in #460
- @hshakula made their first contribution in #475
- @boumenot made their first contribution in #491
Full Changelog: v25.01-v1.5.7-R4...v26.01-v1.5.7-R1