New Vulnerability in 7-Zip Could Allow Crafted XZ Archives to Execute Code During Extraction
Opening an XZ archive created in 7-Zip could allow an attacker to run code on the machine. error, CVE-2026-14266is a heap-based buffer overflow in the way the archive processes XZ data, and Trend Micro’s Zero Day Initiative (ZDI) detailed it on July 15. A fix was posted on June 25 for 7-Zip 26.02.
The overflow allows an attacker to “execute code in the context of the current process,” per the advisory. The code works with the token that 7-Zip itself owns and does not gain its rights.
On Windows, 7-Zip usually runs under a filtered token of a normal user and even an administrator account, so an attacker inherits those limited rights unless the program is started up. The bug came in from Landon Peng of Lunbun LLC, who reported it to 7-Zip on June 5.
ZDI rates a 7.0 error, or High, not many Critical writes have been reached. The full CVSS 3.0 vector is AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. I AV:L it creates a local attack vector, not a network-accessible or unclickable one.
ZDI’s “remote code execution” describes a remote attacker delivering a file, which the victim has yet to open, whether it comes via email, download, or a web page that offers 7-Zip. High attack makes reliable exploitation even more difficult. As of July 20, 2026, Hacker News has found no public evidence of the bug and no credible report of an exploit in the wild.
Hacker News has compared the XZ decoder source for all releases. Maintenance is always in one job, MixCoder_Code in the middle C/XzDec.c. When the XZ stream used the output through a filter, the decoder was given the full length of the output buffer in each pass instead of the space left after the previous write. That gave it more room to work than a managed hard drive, a write-without-limits environment that ZDI describes.
Version 26.02 flushes bytes that have already been written and flushes if that valid value ever overflows the buffer. The same error handling appears to be unchanged in the 7-Zip source back to at least version 21.07 (2021), although neither ZDI nor 7-Zip has said which release is actually usable.
CVE-2026-14266 is the latest in a string of memory protection bugs in 7-Zip archivers. On April 27, version 26.01 fixed a bunch of them, including the high-scoring CVE-2026-48095, an NTFS-handler stack overflow that GitHub Security Lab described on May 22 in a working proof-of-concept. The XZ bug has been silent on both so far, and 26.02 includes all of these fixes, so one update covers them all.
So update to 7-Zip 26.02 or later on every machine that opens archives externally. Manually update the installation from the official site, so set-it-and-forget machines won’t detect it on their own. Any product that ships with a vulnerable copy of 7-Zip’s XZ decoder needs its own fix.
The episode came out 20 days before the advisory, so anyone who reviewed it in late June was covered before the details became public. For once, updating gets you ahead of the curve instead of chasing it.
