Full Report
Opening a crafted XZ archive in 7-Zip could let an attacker run code on the machine. The flaw, CVE-2026-14266, is a heap-based buffer overflow in how the archiver processes XZ chunked data, and Trend Micro's Zero Day Initiative (ZDI) detailed it on July 15. A fix shipped on June 25 in 7-Zip 26.02. The overflow lets an attacker "execute code in the context of the current process," per the
Analysis Summary
# Vulnerability: Heap-Based Buffer Overflow in 7-Zip XZ Decoder
## CVE Details
- **CVE ID:** CVE-2026-14266
- **CVSS Score:** 7.0 (High)
- **CVSS Vector:** `AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H`
- **CWE:** Not specifically cited, but described as a Heap-based Buffer Overflow (CWE-122)
## Affected Systems
- **Products:** 7-Zip (and any third-party products integrating the 7-Zip XZ decoder source).
- **Versions:** Vulnerability confirmed in versions prior to 26.02. Flawed code identified as far back as version 21.07 (2021).
- **Configurations:** Systems that open and extract crafted XZ archives from untrusted sources.
## Vulnerability Description
A heap-based buffer overflow exists in the `MixCoder_Code` function within `C/XzDec.c`. When the XZ decoder applies a filter to a stream, it incorrectly passes the full length of the output buffer for every pass, rather than calculating the remaining space after previous writes. This logic error allows the decoder to write data beyond the allocated buffer boundaries, leading to an out-of-bounds write condition.
## Exploitation
- **Status:** No public Proof-of-Concept (PoC) available; no known exploitation in the wild as of July 2026.
- **Complexity:** High (Requires specific crafted data and successful memory corruption management).
- **Attack Vector:** Local (Categorized as Local because it requires a user to open a file delivered via email, download, or web).
## Impact
- **Confidentiality:** High (Code execution in the context of the current process).
- **Integrity:** High (Potential for unauthorized data modification).
- **Availability:** High (Potential for process crashes or system instability).
- **Note:** On Windows, 7-Zip typically runs with a filtered standard-user token, which limits the attacker's impact to the current user's privileges unless the application was explicitly run as an Administrator.
## Remediation
### Patches
- **7-Zip 26.02:** Released June 25, 2026. This version contains the fix in `MixCoder_Code` that correctly calculates remaining buffer space. Available at: hxxps://www[.]7-zip[.]org/download[.]html
### Workarounds
- **Update Third-Party Software:** Since 7-Zip does not auto-update, manual installation is required. Ensure applications that bundle 7-Zip libraries (like various file managers or security tools) are also updated once their vendors release patches.
- **Caution:** Avoid opening XZ archives from unknown or untrusted sources.
## Detection
- **Indicators of Compromise:** Unusual process behavior from `7z.exe` or `7zFM.exe`, such as unexpected network connections or child process spawning.
- **Detection methods and tools:** Monitor for heap corruption events or crashes in the 7-Zip process when handling XZ files using EDR (Endpoint Detection and Response) tools.
## References
- **7-Zip Official Site:** hxxps://www[.]7-zip[.]org/
- **Trend Micro ZDI Advisory:** hxxps://www[.]zerodayinitiative[.]com/advisories/ZDI-26-444/
- **7-Zip GitHub Source:** hxxps://github[.]com/ip7z/7zip/blob/26.02/C/XzDec[.]c
- **The Hacker News Article:** hxxps://thehackernews[.]com/2026/07/new-7-zip-vulnerability-could-let[.]html