7-Zip CVE-2026-14266: XZ Archive Flaw Allows Code Execution During Extraction

A newly disclosed vulnerability in the widely used 7-Zip archiver could allow attackers to execute arbitrary code when users open a maliciously crafted XZ archive. Tracked as CVE-2026-14266, the flaw is a heap-based buffer overflow in the tool's XZ chunked-data decoder. Trend Micro's Zero Day Initiative (ZDI) published the details on July 15, 2026, rating the bug 7.0 (High) on the CVSS 3.0 scale, despite some early write-ups labeling it Critical. The attack vector is local, with high complexity and required user interaction — the victim must manually open a booby-trapped archive delivered via email, download, or web page. Exploited code runs inside the 7-Zip process and inherits whatever token the archiver was launched with, which on Windows is typically a filtered standard-user token.

The bug was reported to 7-Zip on June 5 by researcher Landon Peng of Lunbun LLC. ZDI's advisory describes how the vulnerability lives in the MixCoder_Code function within C/XzDec.c. When an XZ stream routes its output through a filter, the decoder was being handed the full output-buffer length on each pass instead of the remaining space after earlier writes, creating the out-of-bounds write condition. Version 26.02, released June 25, subtracts bytes already written and exits if the running total exceeds the buffer. The same flawed length-handling pattern appears unchanged in 7-Zip source dating back to at least version 21.07. ZDI and the maintainers have not publicly confirmed which historical releases are exploitable, and as of July 20 there is no public proof-of-concept or confirmed in-the-wild exploitation.

CVE-2026-14266 is the latest in a string of memory-safety issues found in 7-Zip's archive handlers. Version 26.01 (April 27) fixed a separate batch, including the higher-scored CVE-2026-48095, an NTFS-handler heap-write overflow with a working PoC published by GitHub Security Lab on May 22. The 26.02 release rolls up every one of those fixes, so a single update covers the lot. Because 7-Zip updates require a manual install from the official site, unmanaged endpoints will not pick up the patch on their own, and any product bundling a vulnerable copy of the XZ decoder needs its own vendor fix.

Administrators should update every machine that opens archives from untrusted sources to 7-Zip 26.02 or later immediately. Verify the download source against the official site using a WHOIS lookup to avoid spoofed mirrors, and run a quick port scanner on any endpoint suspected of opening a malicious archive to confirm no unexpected services were spawned. As a follow-up, a full privacy checkup can help confirm that no persistence mechanism was installed. The patch went out 20 days before public disclosure, so any team that applied 26.02 in late June was already protected.