A recently identified vulnerability in 7-Zip, a widely used file archiver, could enable attackers to execute arbitrary code on a victim’s system by exploiting specially crafted XZ archives. This flaw, designated as CVE-2026-14266, is a heap-based buffer overflow that arises during the processing of XZ chunked data. The issue was disclosed by Trend Micro’s Zero Day Initiative (ZDI) on July 15, 2026, following its initial report to 7-Zip on June 5. A patch addressing this vulnerability was released on June 25 with the launch of 7-Zip version 26.02.
The vulnerability allows an attacker to execute code within the context of the current process. However, the executed code does not inherit elevated privileges beyond those of the 7-Zip application itself. On Windows systems, 7-Zip typically operates under a standard user token, even when initiated by an administrator account, thereby limiting the potential impact of the exploit unless the program is explicitly run with elevated privileges.
ZDI has assigned a severity rating of 7.0 (High) to this vulnerability, with a CVSS 3.0 vector of AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. This indicates that the attack requires local access, has high complexity, and necessitates user interaction, such as opening a malicious XZ archive. As of July 20, 2026, there have been no public proofs-of-concept or credible reports of this vulnerability being exploited in the wild.
The root cause of the vulnerability lies in the ‘MixCoder_Code’ function within the ‘C/XzDec.c’ file of 7-Zip’s source code. The decoder was incorrectly provided with the full output-buffer length on each pass, rather than accounting for the space already used. This oversight led to an out-of-bounds write condition. The fix implemented in version 26.02 adjusts the function to subtract the bytes already written and terminates the process if the total exceeds the buffer capacity.
It’s noteworthy that similar memory safety issues have been identified in 7-Zip’s archive handlers in the past. For instance, version 26.01, released on April 27, addressed multiple vulnerabilities, including CVE-2026-48095, a heap-write overflow in the NTFS handler. This particular flaw was detailed by GitHub Security Lab on May 22, complete with a working proof-of-concept. The XZ vulnerability, while less severe, underscores the importance of regular updates to maintain system security.
Users are strongly advised to update to 7-Zip version 26.02 or later to mitigate this vulnerability. Since 7-Zip does not feature an automatic update mechanism, users must manually download and install the latest version from the official website. Additionally, any software that incorporates 7-Zip’s XZ decoder should be updated accordingly by the respective vendors.
In the broader context, this vulnerability highlights the ongoing challenges in ensuring the security of widely used open-source software. Regular audits, timely patches, and user vigilance are essential components in maintaining a secure computing environment. Users should remain cautious when handling files from untrusted sources and ensure that all software is kept up to date to protect against potential exploits.
