7-Zip 0-day was exploited in Russia's ongoing invasion of Ukraine

Important context added by the one who found the vulnerability here[1].

A key factor seems to be 7-Zip doesn't just consider file extensions when determining if a file is an archive:

Now the interesting thing is 7-ZIP will not only look at the file extension BUT the files magic bytes "\x37\x7A\xBC\xAF \x27 \x1C" in the header. Recognizing the 7-Zip magic bytes, 7-Zip will then proceed to process this file as an archive, the contents of which will not receive mark-of-the-web protections due to CVE-2025-0411.

[1]: https://arstechnica.com/civis/threads/7-zip-0-day-was-exploi...