A newly disclosed vulnerability in the widely used 7-Zip archiver could allow attackers to execute arbitrary code by convincing a victim to open a specially crafted XZ archive. Tracked as CVE-2026-14266, the issue stems from a heap-based buffer overflow in 7-Zip’s XZ decompression logic and was publicly disclosed by Trend Micro’s Zero Day Initiative (ZDI) on July 15, 2026. Although the vulnerability has been assigned a CVSS v3.0 score of 7.0 (High) rather than Critical, it affects one of the world’s most popular archive utilities, making timely patching essential.
The good news is that a fix has already been available since 7-Zip version 26.02, released on June 25, 2026. Organizations and individual users who updated shortly after the release were protected before the technical advisory became public.
What Is CVE-2026-14266?
CVE-2026-14266 is a heap-based buffer overflow affecting how 7-Zip processes XZ-compressed chunked data during decompression. The vulnerability resides inside the XZ decoder, specifically within the MixCoder_Code() function in C/XzDec.c.
According to ZDI, a remote attacker can exploit the flaw by delivering a specially crafted XZ archive. Exploitation still requires user interaction, meaning the victim must open or extract the malicious archive using a vulnerable version of 7-Zip. If successful, arbitrary code executes in the context of the current 7-Zip process, inheriting the privileges of the user who launched the application.
This distinction is important. Despite being described as a remote code execution (RCE) vulnerability, the flaw is not remotely reachable over the network and is not a no-click vulnerability. The “remote” aspect refers to an attacker remotely delivering a malicious archive through phishing emails, downloads, cloud storage, or compromised websites. The victim must still manually process the archive before exploitation can occur.
Understanding the Root Cause
Internally, decompressing an XZ archive involves multiple decoding passes. Each pass writes decompressed data into an output buffer allocated on the heap.
A simplified workflow looks like this:
Malicious XZ Archive │ ▼Read Compressed Blocks │ ▼LZMA2 Decoder │ ▼Optional Filter Pipeline │ ▼MixCoder_Code() │ ▼Write Decompressed Data │ ▼Output Buffer
The vulnerability arises because the decoder incorrectly tracked the amount of writable space remaining inside the output buffer.
Instead of calculating the remaining available space after previous writes, the vulnerable code repeatedly reused the entire buffer size during successive decoding passes. Conceptually, the vulnerable logic behaved like:
remaining = output_buffer_size;
when it should have calculated:
📬 Stay Ahead of Cyber Threats
Get the latest cybersecurity news, critical vulnerabilities, threat intelligence, tutorials, and exclusive giveaways delivered straight to your inbox. No spam. Unsubscribe anytime.
Subscribe to the Newsletter →
remaining = output_buffer_size - bytes_already_written;
If multiple decoding iterations had already filled part of the destination buffer, subsequent writes could extend beyond the allocated heap memory. This creates an out-of-bounds heap write, the classic condition behind a heap-based buffer overflow.
The patch introduced in version 26.02 corrects this logic by tracking the remaining writable space after each write operation. It also aborts processing whenever the running output offset exceeds the available buffer, preventing memory corruption before it occurs.
Why Heap Buffer Overflows Matter
Heap memory stores dynamically allocated objects that applications request while running. Unlike stack overflows, heap overflows often overwrite neighboring allocations rather than local variables.
A simplified memory layout might resemble:
+---------------------------+| Output Buffer |+---------------------------+| Decoder State |+---------------------------+| Heap Metadata |+---------------------------+| Other Heap Objects |+---------------------------+
When decompressed data exceeds the allocated output buffer, the additional bytes may overwrite adjacent heap structures. Depending on memory layout and exploit reliability, this corruption could overwrite application data, internal object structures, heap allocator metadata, or function pointers.
Modern operating systems implement several exploit mitigations including Address Space Layout Randomization (ASLR), Data Execution Prevention (DEP), and Control Flow Guard (CFG). These protections make reliable exploitation considerably more difficult than in older software. Nevertheless, carefully controlled heap corruption can still provide an attacker with a path toward arbitrary code execution, which is why heap memory vulnerabilities remain among the most serious classes of software flaws.
Why the Vulnerability Is Rated High Instead of Critical
Several reports have described CVE-2026-14266 as a Critical vulnerability. However, the official ZDI advisory assigns a CVSS v3.0 score of 7.0 (High) with the following vector:
AV/AC/PR/UI/S/C/I/A
This rating reflects several important characteristics.
The attack vector is Local (AV) because exploitation requires the victim to process a malicious archive on their own system.
The attack complexity is High (AC), indicating that reliable exploitation is expected to require favorable conditions rather than succeeding consistently.
The vulnerability requires User Interaction (UI) because the victim must open or extract the crafted archive.
Although exploitation may result in high impact to confidentiality, integrity, and availability, these requirements significantly reduce the practical risk compared to network-reachable vulnerabilities that require no user action.
Realistic Attack Scenario
A likely attack chain begins with social engineering rather than direct exploitation.
An attacker prepares a specially crafted XZ archive and delivers it through a phishing email, instant messaging platform, software download site, or cloud-sharing service. The archive may masquerade as source code, logs, backups, or technical documentation to increase the likelihood of being opened.
Once the victim extracts or previews the archive using a vulnerable version of 7-Zip, the malformed compressed data reaches the vulnerable decoder. During decompression, the incorrect buffer length calculations trigger an out-of-bounds heap write, potentially allowing arbitrary code execution.
On Windows, any malicious code executes with the same privileges as the running 7-Zip process. Under normal circumstances, this means code runs with standard user permissions, even if the logged-in account belongs to the local Administrators group. Elevated privileges are only inherited if 7-Zip itself was launched with administrative rights.
Is the Vulnerability Being Exploited?
At the time of writing, there is no public proof-of-concept (PoC) available for CVE-2026-14266, and there are no credible reports of active exploitation in the wild.
The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, and no public threat intelligence currently attributes exploitation to any ransomware group or advanced persistent threat (APT).
However, archive-based delivery remains one of the most common initial access techniques used in phishing campaigns. Even without public exploit code, organizations should not delay patching because attackers frequently reverse engineer vendor patches to develop working exploits after disclosure.
Affected Versions
The official advisory confirms that the vulnerability is fixed in 7-Zip 26.02.
While analysis of the source code suggests that similar vulnerable logic exists in releases dating back to at least version 21.07 (2021), neither ZDI nor the 7-Zip project has officially confirmed the complete list of exploitable versions. Until further clarification becomes available, organizations should treat versions earlier than 26.02 as potentially affected and validate deployed versions through their software inventory.
Mitigation and Recommendations
The primary mitigation is straightforward: upgrade to 7-Zip 26.02 or later.
Unlike many modern desktop applications, 7-Zip does not automatically install updates. Administrators should therefore verify deployed versions manually or distribute the update using centralized software management tools. Users who rely on portable copies of 7-Zip should also ensure those standalone versions are replaced.
Organizations should additionally identify applications that bundle or embed 7-Zip components. Products shipping their own copy of the vulnerable XZ decoder require vendor-specific updates and may not automatically inherit upstream fixes.
Until all systems are updated, security teams should avoid processing archives from untrusted sources, especially externally supplied XZ files. Email filtering, sandbox analysis of compressed attachments, and user awareness training can further reduce exposure during the remediation window.
Disclosure Timeline
The vulnerability was responsibly disclosed by Landon Peng of Lunbun LLC, who reported the issue to the 7-Zip maintainers on June 5, 2026. The vendor released version 26.02 containing the fix on June 25, 2026, nearly three weeks before Trend Micro’s Zero Day Initiative published advisory ZDI-26-444 on July 15, 2026. This gave proactive organizations an opportunity to deploy the update before detailed technical information became publicly available.
Final Thoughts
CVE-2026-14266 serves as another reminder that archive utilities remain attractive targets for attackers. Because these tools routinely process untrusted content received through email, downloads, and file-sharing platforms, even a single memory corruption bug can become an effective entry point for malware delivery.
Although this vulnerability is not a network worm or a no-click exploit, it still presents a meaningful security risk for organizations that frequently exchange compressed files. The absence of public exploit code should not be interpreted as an indication that exploitation is impossible. History has repeatedly shown that attackers often analyze security patches after release to develop reliable exploits.
With a vendor fix already available and no significant compatibility concerns reported, upgrading to 7-Zip 26.02 or later is the most effective way to eliminate the risk. Organizations should also review any third-party software that bundles 7-Zip components to ensure embedded copies of the vulnerable decoder are updated as vendor patches become available.
