New 7-Zip Vulnerability Could Let Crafted XZ Archives Run Code During Extraction
A heap-based buffer overflow in 7-Zip’s XZ decoder (CVE-2026-14266) allows arbitrary code execution when processing crafted archives. The vulnerability stems from incorrect buffer length calculations in the `MixCoder_Code` function, leading to out-of-bounds writes. Fixed in version 26.02 released on June 25, with the public advisory issued later on July 15 by Trend Micro’s Zero Day Initiative. Rated as High severity (CVSS 7.0) due to local attack vector and high complexity, requiring user intera
Analysis
TL;DR
- A heap-based buffer overflow in 7-Zip’s XZ decoder (CVE-2026-14266) allows arbitrary code execution when processing crafted archives.
- The vulnerability stems from incorrect buffer length calculations in the
MixCoder_Codefunction, leading to out-of-bounds writes. - Fixed in version 26.02 released on June 25, with the public advisory issued later on July 15 by Trend Micro’s Zero Day Initiative.
- Rated as High severity (CVSS 7.0) due to local attack vector and high complexity, requiring user interaction to exploit.
- No public proof-of-concept or wild exploitation reports exist as of late July 2026, but manual updates are critical for affected systems.
Why It Matters
This vulnerability highlights the persistent risks of memory safety issues in widely used legacy software like 7-Zip, particularly within archive handlers that process untrusted input. For security practitioners, it underscores the importance of verifying patch status for tools that may be embedded in other applications or deployed manually without automatic update mechanisms. The delayed disclosure relative to the fix date also illustrates a scenario where proactive patching can mitigate risk before public exposure.
Technical Details
- Vulnerability Type: Heap-based buffer overflow in the XZ chunked data processing logic.
- Affected Component: The
MixCoder_Codefunction inC/XzDec.c, where the decoder incorrectly uses the full output-buffer length instead of remaining space after prior writes. - Exploitation Vector: Local file execution; requires a user to open a maliciously crafted
.xzarchive using 7-Zip. - Severity Metrics: CVSS 3.0 score of 7.0 (High); vector string
AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. - Mitigation: Update to 7-Zip version 26.02 or later, which corrects the buffer length calculation and adds bounds checking.
Industry Insight
- Organizations should audit endpoints for manual installations of 7-Zip, as it does not support silent or automated updates, leaving "set-and-forget" machines vulnerable.
- Software vendors embedding 7-Zip components must verify their bundled versions against CVE-2026-14266 and issue patches independently if they ship outdated decoders.
- The discrepancy between the fix release (June 25) and public disclosure (July 15) suggests that timely internal patching can neutralize threats before they become publicly actionable intelligence.
Disclaimer: The above content is generated by AI and is for reference only.