A compressed file is enough to compromise a workstation if 7-Zip is the version doing the opening. The break is in the archive parser, so the dangerous moment is trust in a file that looks harmless, not anything the user later extracts.
7-Zip 26.02 fixes CVE-2025-8088, a remote code execution flaw in archive handling. The trigger is a specially crafted archive, and the issue affects Windows endpoints where people regularly open untrusted compressed files.
The practical risk is simple: patching the archive after the fact does not help if the vulnerable version is still installed. Users who handle outside archives are exposed at the open step, before any payload has to be unpacked.