A recent security vulnerability in 7-Zip, a popular file archiver, has been identified and addressed. The flaw, known as CVE-2026-14266, is a heap-based buffer overflow that could allow an attacker to execute code on a victim's machine when opening a crafted XZ archive. This vulnerability was reported by Landon Peng of Lunbun LLC and detailed by Trend Micro's Zero Day Initiative (ZDI) on July 15, 2026.
The issue lies in the way 7-Zip processes XZ chunked data, specifically in the function MixCoder_Code in C/XzDec.c. By providing a malicious XZ archive, an attacker could exploit this vulnerability to execute code in the context of the current process, potentially gaining control of the system. However, it's important to note that the code runs with the token 7-Zip holds and does not inherit its own privileges.
On Windows, 7-Zip runs under a filtered standard-user token, even for administrator accounts, unless the program is started elevated. This means that the attacker's rights are limited, and the vulnerability is considered a local attack vector, requiring the victim to open the malicious file. ZDI rates the flaw as High (7.0) on the CVSS scale, indicating a significant potential impact.
Interestingly, this is not the first memory-safety bug in 7-Zip's archive handlers. On April 27, version 26.01 fixed a batch of similar vulnerabilities, including the higher-scored CVE-2026-48095, which was a heap-write overflow in the NTFS-handler. The XZ flaw, while quieter, is still a critical issue and has been addressed in version 26.02, which includes all the necessary fixes.
It is crucial for users to update to 7-Zip 26.02 or later to ensure their systems are protected. Manual installation from the official site is required, as set-and-forget machines may not automatically receive the update. Additionally, any product that ships a vulnerable copy of 7-Zip's XZ decoder needs its own vendor fix.
The patch was released 20 days before the advisory, providing a proactive approach to security. Users who updated in late June were already protected before the details were made public. This highlights the importance of staying updated with software patches to stay ahead of potential security threats.
