Heap-based Buffer Overflow in 7-Zip XZ Decompression Impacting Software by Affects 7-Zip Team
CVE-2026-14266
What is CVE-2026-14266?
A heap-based buffer overflow vulnerability has been identified in the XZ decompression function of 7-Zip, enabling remote attackers to execute arbitrary code. The flaw resides in the handling of crafted XZ-compressed data, where an overflow condition can be induced, leading to execution in the context of the current process. Exploiting this vulnerability requires user interaction, as the target must visit a malicious page or open a specially designed file.
Affected Version(s)
7-Zip 26.01
News Articles
CVE-2026-14266: Inside the 7-Zip Heap Overflow Hiding in XZ Archives Since 2021 - Latest Hacking News | Cyber Security News, Hacking Tools and Penetration Testing Courses
7-Zip has patched a heap-based buffer overflow in its XZ decompression code. A specially crafted archive could run arbitrary code the moment a victim extracted it. This 7-Zip vulnerability, tracked as...
NewsbreakCVE-2026-14266Update 7-Zip Now: CVE-2026-14266 Lets Attackers Run Code on Your PC - NewsBreak
7-Zip has a serious security flaw and you need to fix it today. A newly disclosed vulnerability – CVE-2026-14266 – lets attackers run malicious code on you
The Hacker NewsCVE-2026-14266New 7-Zip Vulnerability Could Let Crafted XZ Archives Run Code During Extraction
CVE-2026-14266 is a high-severity heap overflow in 7-Zip’s XZ decoder that could run code when a user opens a crafted archive. Version 26.02 fixes it.