7-Zip

Vulnerabilities in Igor Pavlov's 7-Zip, the open-source archive utility bundled or installed on tens of millions of Windows endpoints. 7-Zip ships without an auto-update mechanism, so parser bugs — heap overflows in Zstd, XZ, or LZMA decompression, path-traversal in extraction — tend to sit on user machines long after the fix is out.