CVE-2026-14266: 7-Zip XZ heap overflow RCE

7-Zip has a heap buffer overflow, CVE-2026-14266. A crafted XZ archive can execute arbitrary code. Zero Day Initiative published the advisory.

Incident overview

On 15 July 2026, Zero Day Initiative (ZDI) published advisory ZDI-26-444 for a heap-based buffer overflow in 7-Zip: CVE-2026-14266, CVSS 7.0 (High). An attacker can run arbitrary code if the user opens a crafted XZ archive or visits a malicious page.

7-Zip is a widely used compressor/decompressor. Landon Peng reported the bug to the 7-Zip developers on 5 June 2026. The fix shipped in 7-Zip 26.02 on 25 June 2026.

Technical details

Root cause

The bug is in how 7-Zip handles XZ compressed data. Parsing of XZ chunked data is flawed: crafted XZ input can overflow a heap buffer.

Decompressing a malicious XZ file triggers the overflow and corrupts adjacent heap structures. A successful exploit runs arbitrary code in the current process context with no prior privileges.

Vulnerability facts

CVE CVE-2026-14266

CVSS v3.1 7.0 (High)

ZDI ZDI-26-444 / ZDI-CAN-30169

Type CWE-122: Heap-based Buffer Overflow

Attack vector Local (user interaction: open a file or visit a page)

Attack complexity High

Impact Complete loss of confidentiality, integrity, and availability

Exploitation scenarios

• Phishing email: send a malicious XZ attachment and induce the user to extract it
• Malicious download: host a malicious XZ archive disguised as a normal file
• Supply-chain contamination: embed malicious XZ data in a software distribution and trigger 7-Zip auto-extract

7-Zip does not deep-inspect archive contents by default, so users can trigger the bug without noticing.

Impact

User interaction and high attack complexity, but 7-Zip's install base still makes this significant:

• Large user base: hundreds of millions of installs across personal, enterprise, and server environments
• Bundled copies: many third-party apps and build pipelines ship 7z.dll; those copies often lag behind upstream
• Social-engineering leverage: phishing already uses archives as malware droppers; this raises the risk of that vector
• In-the-wild: no confirmed exploitation or public PoC

Remediation

Upgrade immediately

7-Zip 26.02 (25 June 2026) contains the fix. Upgrade:

• Individuals: download 26.02 or later from the official 7-Zip site
• Enterprises: push the update via software distribution
• Developers: inventory 7z.dll / 7z library usage and upgrade to a fixed build

Hardening

• Do not open XZ/7z archives from unknown senders or untrusted sources
• Enable deep scanning of compressed attachments on enterprise mail gateways
• Extract suspicious archives in a VM or sandbox
• Audit bundled 7z.dll versions in other applications and push vendors to update
• Train staff to recognize archive attachments in phishing mail

References

• Zero Day Initiative: ZDI-26-444 advisory
• Tencent Security: 7-Zip vulnerability exposes millions of users to RCE
• CN-SEC: technical analysis of 7-Zip CVE-2026-14266
• 7-Zip official release history and changelog