New 7-Zip Vulnerability Could Let Crafted XZ Archives Run Code During Extraction
Summary: A heap-based buffer overflow in 7-Zip's handling of XZ chunked data, CVE-2026-14266, could let a crafted XZ archive execute code in the context of the current process when opened, and Trend Micro's Zero Day Initiative detailed it on July 15. A fix shipped June 25 in 7-Zip 26.02, which subtracts bytes already written in the MixCoder_Code function in C/XzDec.c and bails out if the running total exceeds the buffer; ZDI rates the flaw 7.0 High with the vector AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, and as of July 20, 2026, The Hacker News found no public proof-of-concept and no credible report of exploitation in the wild.
Why it matters: The same flawed length handling appears unchanged in 7-Zip source back to at least version 21.07 from 2021, and updating is a manual install from the official site, so set-and-forget machines will not pick up 26.02 on their own.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2026-14266CVE-2026-48095
- Related
- ⚡ Weekly Recap: New Linux Flaw, PAN-OS Exploit, AI-Powered Attacks, OAuth Phishing and More Cyber Risks ·⚡ Weekly Recap: Word Press RCE, Sonic Wall 0-Days, AI Service Attacks, Share Point 0-Day and More Cyber Risks ·New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026