"execute code in the context of the current process," Trend Micro's Zero Day Initiative warned in its advisory.
CVE-2026-14266 and the 7-Zip 26.02 update
The flaw tracked as CVE-2026-14266 is a heap-based buffer overflow in 7-Zip's handling of XZ chunked data. Trend Micro's Zero Day Initiative (ZDI) published details on July 15 after the bug was reported to 7-Zip on June 5 by Landon Peng of Lunbun LLC. A fix was released earlier: 7-Zip 26.02 shipped on June 25 and includes the correction for this XZ decoder issue alongside other memory-safety repairs.
How the overflow happens in the XZ decoder
The vulnerability lies in the XZ decoder, specifically in a function named MixCoder_Code inside C/XzDec.c. When an XZ stream processes output through a filter, the decoder was passed the full output-buffer length on every pass instead of the remaining space after previous writes. That miscalculation allowed an out-of-bounds write — the heap-based overflow ZDI describes. The patch in 26.02 subtracts the bytes already written and bails out if the running total would exceed the buffer.
Exploitability, score, and observed activity
ZDI assigns the flaw a score of 7.0 (High) and provides the full CVSS 3.0 vector: AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. The AV:L component makes the vector local — the victim must open the crafted archive rather than be compromised by a network-only, no-click action. ZDI's description of "remote code execution" refers to an attacker delivering a file remotely (by email, download, or a web page) that the victim then opens with 7-Zip. The CVSS vector also reflects high attack complexity.
As of July 20, 2026, The Hacker News reported no public proof-of-concept and no credible reports of exploitation in the wild. The Hacker News compared the XZ decoder source across releases to locate the fix and found the same flawed length handling present in 7-Zip source back to at least version 21.07 (2021), though neither ZDI nor 7-Zip has said which releases are actually exploitable.
Windows behavior and the limits of a successful exploit
The advisory notes that, if triggered, the overflow can let an attacker "execute code in the context of the current process." The injected code runs with the token 7-Zip holds and gains no privileges of its own. On Windows, a normally launched 7-Zip runs under a filtered standard-user token even on an administrator account, so an attacker would inherit those limited rights unless 7-Zip had been started elevated. That constraint reduces the degree of privilege an exploit would yield on a typical Windows desktop.
What this means for technologists, vendors, and end users
- Technologists and security teams: Update to 7-Zip 26.02 or later on any machine that opens archives from outside sources. Note that the update is a manual install from the official site; machines that are "set-and-forget" will not pick it up automatically.
- Vendors that ship the 7-Zip XZ decoder: Any product that includes a vulnerable copy of 7-Zip's XZ decoder will need to ship its own vendor fix to protect customers, because the consolidated 26.02 binary is the upstream remedy.
- End users and administrators: Because the bug requires a user to open a crafted archive, regular caution with untrusted files remains effective; installing 26.02 or later removes the specific vulnerability discussed here. The patch went public 20 days before ZDI's advisory, so systems updated in late June were protected before full disclosure.
The XZ overflow is the latest in a short run of memory-safety fixes for 7-Zip; April's 26.01 release addressed multiple issues including CVE-2026-48095, which had a higher score and a public proof-of-concept. 7-Zip 26.02 rolls those fixes together, giving administrators a single update that covers multiple risks. One remaining practical question is which older releases are actually exploitable in the wild — a detail neither ZDI nor 7-Zip has specified.
