New 7-Zip Vulnerability Could Let Crafted XZ Archives Run Code During Extraction
A vulnerability (CVE-2026-14266) in 7-Zip’s XZ archive handling allows an attacker to execute code on a victim machine by crafting a malicious XZ archive. The vulnerability stems from a buffer overflow when processing XZ chunked data, and a patch was released on June 25th. While a proof-of-concept is not yet available, users should update to version 26.02 or later to mitigate the risk.
A vulnerability (CVE-2026-14266) in 7-Zip’s XZ archive handling allows an attacker to execute code on a victim machine by crafting a malicious XZ archive. The vulnerability stems from a heap-based buffer overflow in how the archiver processes XZ chunked data. Trend Micro’s Zero Day Initiative (ZDI) detailed the flaw on July 15th. The bug was reported by Landon Peng of Lunbun LLC on June 5th. The fix landed in 7-Zip 26.02 on June 25th.
On Windows, a normally launched 7-Zip runs under a filtered standard-user token even on an administrator account, so the attacker inherits those limited rights unless the program was started elevated. The ZDI rates the flaw 7.0, or High, not the Critical several write-ups reached for. The full CVSS 3.0 vector is AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. The AV:L makes it a local attack vector, not a network-reachable or no-click one.
ZDI’s “remote code execution” describes a remote attacker delivering the file, which the victim still has to open, whether it arrives by email, a download, or a web page that hands it to 7-Zip. The high attack complexity makes reliable exploitation harder still. As of July 20, 2026, The Hacker News found no public proof-of-concept for the bug and no credible report of exploitation in the wild.
ZDI compared the XZ decoder source across releases. The fix lands in one function, MixCoder_Code in C/XzDec.c. When an XZ stream runs its output through a filter, the decoder was handed the full output-buffer length on each pass instead of the space left after earlier writes. That gave it more room to work with than the buffer held, the out-of-bounds write condition ZDI describes.
Version 26.02 subtracts the bytes already written and bails out if that running total ever exceeds the buffer. The same flawed length handling appears unchanged in 7-Zip source back to at least version 21.07 (2021), though neither ZDI nor 7-Zip has said which releases are actually exploitable.
CVE-2026-14266 is the latest in a run of memory-safety bugs in 7-Zip’s archive handlers. On April 27, version 26.01 fixed a batch of them, including the higher-scored CVE-2026-48095, an NTFS-handler heap-write overflow that GitHub Security Lab detailed on May 22 with a working proof-of-concept. The XZ flaw is the quieter of the two so far, and 26.02 rolls up every one of these fixes, so one update covers them all.