New 7-Zip Vulnerability CVE-2026-14266 Allows Code Execution via Crafted XZ Archives

A critical vulnerability in 7-Zip, identified as CVE-2026-14266, allows attackers to execute arbitrary code by tricking users into opening a specially crafted XZ archive. The flaw is a heap-based buffer overflow in the XZ decoder’s MixCoder_Code function within C/XzDec.c. When processing XZ streams with filters, the decoder incorrectly used the full output-buffer length on each pass instead of the remaining space, leading to an out-of-bounds write condition.

Discovered by Landon Peng of Lunbun LLC and reported on June 5, 2026, the issue was fixed in 7-Zip version 26.02, released on June 25, 2026. Trend Micro’s Zero Day Initiative (ZDI) publicly disclosed the vulnerability on July 15, 2026, assigning a CVSS v3.0 score of 7.0 (High) with vector AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. The local attack vector requires user interaction, such as opening a malicious file delivered via email or download.

As of July 20, 2026, no public proof-of-concept or active exploitation has been reported. The same flawed length handling existed in 7-Zip source code back to version 21.07 (2021), though the exploitable range is unconfirmed. This vulnerability follows a series of memory-safety bugs in 7-Zip, including CVE-2026-48095, an NTFS-handler overflow fixed in version 26.01. Users are urged to update to 7-Zip 26.02 or later manually, as automatic updates are not supported. Organizations using products that bundle vulnerable 7-Zip code should seek vendor patches.