A recent security vulnerability in 7-Zip, a popular file archiver, has been identified and addressed. This vulnerability, known as CVE-2026-14266, could potentially allow an attacker to execute code on a victim's machine by crafting a malicious XZ archive. The flaw lies in the way 7-Zip processes XZ chunked data, specifically in the MixCoder_Code function within the C/XzDec.c file. It was reported by Landon Peng of Lunbun LLC and detailed by Trend Micro's Zero Day Initiative (ZDI) on July 15, 2026.
The vulnerability is a heap-based buffer overflow, which means it can lead to code execution in the context of the current process. However, it's important to note that the code runs with the token 7-Zip holds, and it gains no additional privileges. On Windows, 7-Zip typically runs under a filtered standard-user token, even for administrator accounts, so the attacker's rights are limited unless the program is started elevated.
ZDI rates this flaw as High (7.0) on their severity scale, with a CVSS 3.0 vector indicating a local attack vector, high attack complexity, and high impact on confidentiality, integrity, and availability. Interestingly, as of July 20, 2026, no public proof-of-concept or credible reports of exploitation in the wild have been found, suggesting that the vulnerability might not be as widely exploited as some others.
The fix for this vulnerability was released in 7-Zip version 26.02 on June 25, 2026. It addresses the issue by subtracting the bytes already written and bailing out if the running total exceeds the buffer. This fix has been backported to versions as far back as 21.07, but it's not clear which releases are still exploitable.
This vulnerability is not an isolated incident; it's the latest in a series of memory-safety bugs found in 7-Zip's archive handlers. On April 27, version 26.01 fixed a batch of similar vulnerabilities, including the higher-scored CVE-2026-48095, an NTFS-handler heap-write overflow. The XZ flaw, while less severe, is still a significant concern, especially considering the widespread use of 7-Zip.
To protect themselves, users are advised to update to 7-Zip version 26.02 or later, as this update covers all the fixes, including the XZ vulnerability. However, it's worth noting that updating requires a manual install from the official site, so set-and-forget machines might not automatically receive the update.
In conclusion, this vulnerability highlights the importance of keeping software up to date and being cautious when opening files from untrusted sources. While the exploitability of this flaw might be limited, it serves as a reminder that even seemingly minor vulnerabilities can have significant consequences. As always, staying informed and proactive in security measures is crucial.
