Update 7-Zip and WinRAR on Windows: Check Versions, Patch CVE-2026-14191 and Automate Updates

Here is the catch that catches veteran users and casual PC owners alike: neither 7-Zip nor WinRAR includes a built-in automatic updater, nor do they even offer a simple "Check for Updates" button inside their menus. As a result, millions of Windows machines are quietly running versions installed months or years ago, missing critical security patches that only work if you manually go out and install them.

Why Outdated File Archivers Are a Security Blind Spot​

File archivers sit on the front lines of your system's defenses. Whenever you download a compressed bundle of documents, modding files, or software utilities, your archiver has to parse complex header structures, directory trees, and recovery records before a single file even touches your folder. If there is a flaw in how the archiver reads that metadata, a specially crafted archive can turn a routine extraction or repair job into a security incident.

MakeUseOf recently highlighted this maintenance gap, pointing out that while bothRARLAB and 7-Zip developer Igor Pavlov are quick to patch security flaws, the lack of automatic updates leaves users exposed until they manually intervene. However, it is important to separate generalized alarm from the exact technical reality of how these vulnerabilities work—and what versions you should actually be looking for today.

The WinRAR 7.23 Security Fixes (and the 7.30 Beta)​

A prime example of why version checks matter arrived on June 30, 2026, when RARLAB released WinRAR 7.23 final. This security-focused update resolved a high-severity out-of-bounds heap write vulnerability tracked as CVE-2026-14191 (carrying a CVSS score of 7.8).

According to the GitHub Advisory Database and RARLAB's release notes, the flaw resides in how WinRAR, RAR, and UnRAR parse RAR5 recovery volumes (.rev files) (UnRAR.dll does not process recovery volumes and is unaffected). Specifically, when processing a set of two or more crafted .rev files, the software failed to properly validate array indices against the initial allocation size, allowing an attacker-controlled value to overwrite adjacent heap memory.

It is worth keeping a level head about how this is triggered: merely having an older copy of WinRAR installed on your drive does not magically hand remote control of your PC to an attacker. Triggering CVE-2026-14191 requires user interaction—specifically, running a recovery or test operation on an attacker-supplied set of .rev files (such as clicking "Repair archive" in WinRAR, running unrar t on a .rev set, or triggering auto-recovery when extracting a multi-part archive that is missing a .rar volume).

In the same WinRAR 7.23 release, RARLAB also patched a separate crafted-archive flaw involving symbolic links that could point outside the intended extraction folder, adding stricter path checks across extraction commands. That follows earlier, high-profile lessons in the archiver space, such as CVE-2025-8088—a critical path-traversal vulnerability patched in WinRAR 7.13 in July 2025 that Google Threat Intelligence later noted was actively exploited by state-backed and financially motivated threat actors dropping payloads into the Windows Startup folder.

Current Version Benchmarks (October 2026)​

If you are auditing your system today, here are the exact official version numbers listed by both vendors:

Note on 7-Zip history: While security blogs and outlets like Kevin The Tech Guy have periodically reminded users to manually patch 7-Zip—such as after version 24.09 (November 2024) addressed a Windows Mark-of-the-Web security warning bypass, or following the 26.02 update in June 2026 —Igor Pavlov has continued shipping regular maintenance builds, culminating in 7-Zip 26.04 on October 5, 2026.

Section Summary: Neither 7-Zip nor WinRAR will warn you when a security patch drops. Keeping WinRAR on at least 7.23 and 7-Zip on 26.04 ensures that known heap-corruption, path-traversal, and archive-parsing bugs are closed before you open your next downloaded archive.

Step-by-Step: How to Check and Update Your Archivers Manually​

Because neither program includes an internal updater, verifying your installation takes about thirty seconds of manual detective work.

Checking and Updating 7-Zip​

• Open the 7-Zip File Manager from your Start Menu.
• Click Help > About 7-Zip on the top menu bar.
• Check the version number and date displayed at the top of the dialog box.
• If you are running anything older than 26.04 (2026-10-05), click the ** button at the bottom of the About window.
• Download the appropriate .exe installer for your system—64-bit x64 for standard modern Windows PCs, 64-bit ARM64 for Snapdragon/ARM laptops, or 32-bit x86 for legacy systems—and run the installer right over your existing copy.

Checking and Updating WinRAR​

• Launch WinRAR from your Start Menu.
• Navigate to Help > About WinRAR.
• Check the version number listed in the window.
• If your version is older than 7.23, click the Home page button in the dialog box to open the official WinRAR site.
• Navigate to the Downloads section, grab the WinRAR 7.23 64-bit installer for your preferred language (unless you specifically want to test 7.30 Beta 1), run the executable, approve the User Account Control prompt, and click Install.

Section Summary: A quick trip to the Help > About menu in either app reveals your exact build. Installing the latest official executable over your current installation preserves your preferences while swapping out the vulnerable binaries.

Automating Updates with UniGetUI (and What to Watch Out For)​

Updating an app once is easy; remembering to check a website every month for the rest of your PC's lifespan is where human nature fails. Even though Windows 11 version 23H2 and later include native File Explorer support for unpacking .rar, .7z, .tar, and .gz archives, power users overwhelmingly stick with dedicated archivers for faster performance, archive creation, password protection, and split-volume handling.

To close the manual update gap across your entire PC, MakeUseOf recommends UniGetUI (formerly WingetUI), a free, open-source graphical interface created by Martí Climent and now maintained under the stewardship of Devolutions.

How UniGetUI Bridges the Gap​

Instead of forcing you to open Command Prompt or PowerShell to run winget upgrade commands manually, UniGetUI wraps Windows package managers—including WinGet, Scoop, Chocolatey, npm, pip, and PowerShell Gallery—into a single system tray application. According to the official Devolutions UniGetUI documentation on GitHub, the tool allows you to:

• Schedule Maintenance: Configure update checks on a custom time interval, or set them to run daily or weekly at a specific time.
• Automate or Notify: Choose whether updates install automatically after every check (or on a daily/weekly schedule) or simply trigger a Windows notification so you can review them first.
• Granular Package Control: Exclude specific apps from auto-updating, skip buggy versions, or restrict automatic updates to a hand-picked whitelist of trusted packages.

Important Caveats for Windows Power Users​

While UniGetUI is a fantastic utility for taming third-party software sprawl, IT veterans know that no package manager is magic. Keep three practical realities in mind when setting it up:

• Check Your Scheduling Settings: Rather than assuming UniGetUI silently updates everything out of the box on a fixed timer, open its settings and verify your preferred check interval and whether unattended installation is enabled.
• Package Discovery Depends on Installation Source: UniGetUI relies on underlying package managers like WinGet to match your installed programs against repository manifests. While standard installations of 7-Zip and WinRAR are generally detected via WinGet, custom portable builds or non-standard directory installs may not always map cleanly. After installing UniGetUI, check its Installed Packages tab to confirm both 7-Zip and WinRAR are recognized and tied to an active source like WinGet.
• Verify Version Lag: Community-maintained package repositories occasionally trail a vendor's website release by a day or two. If an urgent security advisory drops, checking the vendor's site directly remains the fastest way to get a zero-day or n-day patch.

Whether you prefer the discipline of a manual check or the convenience of a scheduled package manager like UniGetUI, take two minutes today to open your archiver's About menu. Your right-click menu will work just the same afterward—only without the hidden baggage of yesteryear's vulnerabilities.

Correction (October 17, 2026): 7-Zip 26.02 was released June 25, 2026, not July 2026; and the PC Gamer attributions were removed since no PC Gamer coverage of the cited items was found (the underlying facts are verified via Google Threat Intelligence and Kevin The Tech Guy).