A high-severity vulnerability in the popular file archiver 7-Zip allows attackers to execute arbitrary code by tricking users into opening a specially crafted XZ archive. The flaw, designated CVE-2026-14266, was disclosed by Trend Micro's Zero Day Initiative (ZDI) on July 15, though a patch had already been released 20 days earlier.
The bug sits in how 7-Zip processes XZ compressed data. When an archive passes through a filter during decompression, the decoder was incorrectly handed the full output buffer length on each pass rather than the remaining space. This miscalculation creates an out-of-bounds write condition, a classic heap-based buffer overflow that an attacker can exploit to hijack the process.
How the Attack Works
The vulnerability is not a no-click, network-reachable exploit. An attacker must first deliver a malicious XZ file to the victim, typically through email, a compromised download, or a malicious webpage that hands the file to 7-Zip. The user must then actively open the archive for the exploit to trigger.
Once triggered, the attacker's code runs with whatever privileges 7-Zip itself holds. On Windows, a standard 7-Zip installation operates under a medium integrity level even on administrator accounts, meaning the attacker gains no special system rights unless the user explicitly launched the program with elevated permissions. ZDI rates the flaw 7.0 (High) on the CVSS 3.0 scale, not Critical, because of this local attack vector and the high complexity required for reliable exploitation.
The Fix and What Changed
Developer Igor Pavlov shipped the fix in 7-Zip version 26.02 on June 25. The patch modifies the XZ decoder to subtract bytes already written to the buffer and abort the operation if the running total ever exceeds the allocated space. The Hacker News reviewed the source code across releases and found the same flawed length calculation present as far back as version 21.07, released in 2021. Neither ZDI nor 7-Zip has confirmed exactly which versions are exploitable, but the pattern suggests the bug may have been dormant for years.
The issue was reported responsibly by Landon Peng of Lunbun LLC on June 5, giving the developer three weeks to patch before public disclosure. As of July 20, 2026, no public proof-of-concept has surfaced, and there are no credible reports of active exploitation in the wild.
Part of a Broader Pattern
CVE-2026-14266 is the second significant memory-safety flaw in 7-Zip's archive handlers this year. On April 27, version 26.01 fixed another batch of vulnerabilities, including CVE-2026-11234, an NTFS-handler heap-write overflow rated higher on the severity scale. That flaw had a working proof-of-concept published by May 22, making it the more urgent of the two at the time. Version 26.02 rolls up all these fixes, so a single update closes every known hole.
This pattern of bugs in archive parsers is not unique to 7-Zip. File format decoders are notoriously difficult to secure because they must handle edge cases in compressed data streams, and a single off-by-one error in buffer arithmetic can become a full code execution vulnerability. Other archivers, including WinRAR and older versions of Windows' built-in tools, have faced similar issues over the years.
What Users Should Do Now
Anyone using 7-Zip to open archives from external sources, email attachments, or downloads should update to version 26.02 or later immediately. Unlike many modern applications, 7-Zip does not include an automatic updater. Users must download and install the new version manually from the official website. IT administrators should audit their environments for machines running older builds, as these will not self-patch.
Third-party products that embed 7-Zip's XZ decoder, including certain backup tools and security scanners, may also need vendor-supplied updates if they ship a vulnerable copy of the library. The patch released on June 25 means anyone who updated promptly was protected before the technical details became public, a rare case where proactive patching put defenders ahead of the disclosure curve.
Watch for any vendor advisories from software that bundles 7-Zip components, and keep an eye on ZDI's tracker in case additional related flaws emerge from the same decoder code.