Opening a maliciously crafted XZ archive in **7-Zip** could enable an attacker to execute arbitrary code on the victim's machine. The flaw, designated **CVE-2026-14266**, stems from a heap-based buffer overflow in how the popular archiving tool processes XZ chunked data. **Trend Micro's Zero Day Initiative (ZDI)** publicly detailed the vulnerability on July 15, following a fix that shipped with **7-Zip** version 26.02 on June 25. ### Understanding the Vulnerability According to the advisory, the buffer overflow permits an attacker to "execute code in the context of the current process." This means the malicious code would operate with the same privileges as the **7-Zip** application itself. On **Windows**, a standard launch of **7-Zip** typically runs under a filtered standard-user token, even on administrator accounts, thereby limiting the attacker's inherited rights unless the program was explicitly run with elevated privileges. **Landon Peng** of **Lunbun LLC** discovered and reported the bug to **7-Zip** on June 5. ### CVSS Rating and Attack Complexity **ZDI** has rated **CVE-2026-14266** as 7.0, categorizing it as 'High' severity, rather than the 'Critical' rating some initial reports suggested. The full CVSS 3.0 vector is `AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H`. The `AV:L` component signifies a local attack vector, meaning the attacker cannot exploit this remotely without user interaction. While **ZDI** describes it as "remote code execution," this implies a remote attacker delivering the malicious file, which the victim must still open. The high attack complexity (`AC:H`) further suggests that reliable exploitation is challenging. As of July 20, 2026, no public proof-of-concept (PoC) or credible reports of in-the-wild exploitation have emerged. ### Technical Deep Dive into the Fix A comparison of the XZ decoder source across **7-Zip** releases reveals that the patch resides within the `MixCoder_Code` function in `C/XzDec.c`. The vulnerability arose because the decoder was passed the full output-buffer length on each pass when an XZ stream ran its output through a filter, instead of the remaining available space after previous writes. This oversight allowed the decoder to write beyond the buffer's allocated memory, leading to the out-of-bounds write condition. Version 26.02 addresses this by subtracting the bytes already written and terminating the process if the running total ever exceeds the buffer's capacity. This flawed length handling appears to have been present in **7-Zip** source code since at least version 21.07 (2021), though the exact range of exploitable releases has not been fully disclosed by **ZDI** or **7-Zip**. ### Broader Context of 7-Zip Vulnerabilities **CVE-2026-14266** is the latest in a series of memory-safety bugs discovered in **7-Zip**'s archive handlers. On April 27, version 26.01 resolved several other issues, including the higher-scored **CVE-2026-48095**. This vulnerability, an NTFS-handler heap-write overflow, was detailed by **GitHub Security Lab** on May 22, complete with a working proof-of-concept. The XZ flaw, while significant, has garnered less immediate attention. Crucially, **7-Zip** 26.02 bundles all these recent fixes, offering a comprehensive update for users. ### Call to Action: Update Immediately IT security professionals and privacy-conscious users are strongly advised to update all instances of **7-Zip** to version 26.02 or later, especially on machines that process external archives. As **7-Zip** updates are typically manual installations from the official website, automated systems or 'set-and-forget' deployments will not automatically apply the patch. Furthermore, any third-party products that embed a vulnerable version of **7-Zip**'s XZ decoder will require their own vendor-specific updates. The patch was released 20 days prior to the public advisory, meaning those who updated in late June were proactively protected. This is a rare instance where updating *ahead* of public disclosure has offered a significant security advantage.