// NEXUSVOID CYBER NEWS
<- ALL CYBER NEWS
High
7-Zip, XZ, buffer overflow, CVE-2026-14266, code execution, patch
7-Zip CVE-2026-14266: Crafted XZ Archives Can Run Code
7-Zip CVE-2026-14266 is a heap buffer overflow in the XZ decoder that can run code when you extract a crafted archive. Affected back to 21.07, fixed in 7-Zip 26.02. Update now.
Published July 21, 2026.
7-Zip CVE-2026-14266 is a heap-based buffer overflow in the XZ decoder that can run attacker code when you open or extract a crafted XZ archive. It affects 7-Zip builds going back to at least 21.07 and is fixed in 7-Zip 26.02 — update now, because opening a booby-trapped archive is all it takes.
What happened. Researchers disclosed CVE-2026-14266, a heap-based buffer overflow in how 7-Zip processes XZ chunked data. The flaw lives in the MixCoder_Code function in C/XzDec.c: the decoder was handed the full output-buffer length on each pass instead of the space remaining after earlier writes, creating an out-of-bounds write. Extracting a crafted XZ archive can corrupt memory and lead to code execution. Landon Peng of Lunbun LLC reported it to 7-Zip on June 5, 2026; version 26.02 (released June 25, 2026) fixes it by subtracting already-written bytes and validating that the total does not exceed buffer capacity.
How serious is 7-Zip CVE-2026-14266?
CVE-2026-14266 carries a CVSS 3.0 score of 7.0 (High). As of July 20, 2026, there is no public proof-of-concept and no confirmed in-the-wild exploitation. The risk is that the trigger is ordinary: simply extracting a malicious .xz archive — a common action for anyone who handles downloads, email attachments, or build artifacts.
Which 7-Zip versions are affected?
Version | Status |
|---|---|
7-Zip 21.07 through pre-26.02 | Affected (per available detail, back to at least 21.07 / 2021) |
7-Zip 26.02 (June 25, 2026) | Fixed |
7-Zip does not auto-update, so vulnerable builds persist on machines until users manually upgrade.
What to do now.
Update to 7-Zip 26.02 or later on every workstation and server, and on build/CI images that bundle 7-Zip.
Do not open untrusted XZ archives on unpatched machines — extraction alone triggers the flaw.
Inventory bundled copies: 7-Zip is frequently shipped inside installers and automation; patch those too.
Who's affected. Anyone running 7-Zip below 26.02 who extracts XZ archives — including automated pipelines that unpack untrusted archives without a human in the loop.
Our read. The verifiable detail here is that this bug is old: the vulnerable MixCoder_Code path traces back to builds from 2021, so a "current enough" 7-Zip on a developer laptop or a CI image can still be years behind on this fix. There is no KEV listing and no public exploit yet — but a memory-corruption bug in a file-extraction tool used across build pipelines is precisely the kind that gets weaponized once details are public, and NVD-style scoring routinely undersells a widely-deployed decoder flaw. Verifying the actual installed 7-Zip version across your fleet, including bundled copies, beats assuming everyone is current.
Reporting by The Hacker News; technical detail per the Zero Day Initiative and 7-Zip's changelog. Sources linked above. Related: our continuous verification approach.