<- ALL CYBER NEWS
High
7-Zip, XZ, buffer overflow, CVE-2026-14266, code execution, patch, endpoint
7-Zip CVE-2026-14266: Opening One XZ Archive Can Run Code
7-Zip CVE-2026-14266 is a heap overflow in the XZ decoder — opening a crafted .xz archive can run code. Affected back to 21.07, fixed in 26.02. Update now.
7-Zip CVE-2026-14266: Opening One XZ Archive Can Run Code
7-Zip CVE-2026-14266 is a heap-based buffer overflow in the XZ decoder that can run attacker-controlled code when you open or extract a crafted .xz archive. It affects 7-Zip builds going back to at least version 21.07 and is fixed in 7-Zip 26.02, and because 7-Zip has no auto-update, the only remediation is to install the new build manually. The trigger is ordinary: opening a single booby-trapped archive is all it takes, which is exactly why a "medium-noise" 7.0 deserves attention on any machine that handles downloads, email attachments, or build artifacts.
Researchers disclosed CVE-2026-14266 (CWE-122, heap-based buffer overflow) as a flaw in how 7-Zip processes XZ chunked data. The bug lives in the MixCoder_Code function in C/XzDec.c: on each decoding pass the decoder was handed the full output-buffer length instead of the space actually remaining after earlier writes, producing an out-of-bounds write. Extracting a malicious XZ archive can corrupt heap memory and lead to code execution in the context of the user running 7-Zip. Landon Peng of Lunbun LLC reported it to the project on June 5, 2026, and version 26.02, released June 25, 2026, fixes it by subtracting the already-written bytes and validating that the running total never exceeds the buffer's capacity.
How serious is 7-Zip CVE-2026-14266?
It carries a CVSS 3.0 score of 7.0 (High), and as of late July 2026 there is no public proof-of-concept and no confirmed in-the-wild exploitation, with EPSS sitting around the 56th percentile. That "not exploited yet" status is the reason to patch on your own schedule rather than in a panic, but it is not a reason to skip it. The exposure is unusually broad because the vulnerable code has shipped since at least 2021, 7-Zip is installed on an enormous number of Windows machines, and the tool never updates itself, so old builds linger indefinitely. The realistic attack path is social: a malicious .xz delivered as an attachment or download that runs the moment a user extracts it.
Which 7-Zip versions are affected, and how do I fix it?
Everything from 7-Zip 21.07 up to (but not including) 26.02 is affected per the available detail; 26.02 is the fixed release. Because there is no automatic updater, the fix has to be pushed deliberately, through your endpoint-management tooling on managed fleets, or by manually downloading 26.02 on standalone machines.
Version | Status |
|---|---|
7-Zip 21.07 through pre-26.02 | Affected (back to at least 21.07 / 2021) |
7-Zip 26.02 (June 25, 2026) | Fixed |
CVSS / CWE | 7.0 High / CWE-122 heap buffer overflow |
Exploitation | No public PoC or in-the-wild activity as of late July 2026 |
Reported / fixed by | Landon Peng (Lunbun LLC), June 5 → fix June 25, 2026 |
Our read
This is the kind of vulnerability a point-in-time audit quietly misses: it is not internet-facing, it will not light up a perimeter scan, and its 7.0 score sorts below the day's 9.8s, yet it sits on thousands of endpoints as unmanaged software that never updates itself. Understanding your real risk means knowing where 7-Zip is actually installed and which builds are running, continuously, rather than assuming a desktop utility is somebody else's problem. An accurate software inventory turns "opening one archive can run code" from an unknown into a one-line remediation task, the difference between verifiable coverage and hoping nobody double-clicks the wrong .xz.
Reporting by The Hacker News; vulnerability detail per NVD and the 7-Zip project; CVSS and CWE per NVD. Sources linked above.
Related: VMware CVE-2026-59309: vCenter auth bypass and VM escape · What CVSS and EPSS miss for patch prioritization
Frequently asked questions
Is CVE-2026-14266 being exploited in the wild?
No. As of late July 2026 there is no public proof-of-concept exploit and no confirmed in-the-wild exploitation, and it is not in CISA's KEV catalog. The risk is the low bar to trigger it, extracting a single crafted archive, combined with how widely old 7-Zip builds persist.
What versions of 7-Zip are vulnerable?
Builds from at least 21.07 (2021) up to but not including 26.02. Version 26.02, released June 25, 2026, contains the fix.
How do I update 7-Zip?
Manually. 7-Zip has no auto-update mechanism, so download and install 26.02 from the official site, or deploy it through your endpoint-management tooling. Vulnerable builds remain on machines until someone actively upgrades them.
What actually causes the flaw?
A heap buffer overflow in the MixCoder_Code function in C/XzDec.c: the XZ decoder was given the full output-buffer length each pass instead of the remaining space, allowing an out-of-bounds write. Version 26.02 fixes it by accounting for already-written bytes and enforcing the buffer's capacity.