Skip to content

7-Zip Remote Code Execution Vulnerability (CVE-2026-14266)

alt text

CVE-2026-14266 7-Zip Heap Overflow XZ Archive Parsing RCE Risk

Overview

A heap-based buffer overflow vulnerability was identified in 7-Zip while processing XZ-compressed archives. A specially crafted malicious archive can trigger memory corruption when opened or extracted with vulnerable 7-Zip versions, potentially enabling arbitrary code execution with the current user's privileges.

The issue is fixed in 7-Zip version 26.02.

Technical Specifications

Attribute Details
CVE ID CVE-2026-14266
Affected Component XZ archive decompression/parser logic in 7-Zip
Vulnerability Type Heap-based Buffer Overflow (memory corruption)
Root Cause Improper validation of malformed XZ-compressed data causing out-of-bounds operations during decompression
Attack Vector Malicious archive delivery (email, downloads, sharing services, other file channels)
User Interaction Required (victim opens or extracts crafted archive)
Affected Versions 7-Zip versions prior to 26.02
Fixed Version 7-Zip 26.02
Privilege Context Code execution under current user context

Affected Products

  • Endpoints running vulnerable 7-Zip versions before 26.02
  • User workflows that process untrusted archive attachments or downloaded files
  • Enterprise environments where archive extraction tools are widely deployed

Attack Scenario

  1. An attacker crafts a malicious archive containing malformed XZ data.
  2. The archive is distributed through phishing, downloads, file-sharing, or other channels.
  3. A victim opens or extracts the archive using vulnerable 7-Zip software.
  4. Malformed XZ content triggers heap corruption during decompression.
  5. Arbitrary code executes in the victim user context, enabling malware installation and follow-on compromise.

Impact Assessment

  • Attackers may execute arbitrary payloads and alter host state
  • Malware or ransomware deployment can modify files and system configurations
  • Persistence mechanisms can be planted for ongoing control
  • Credential theft and sensitive data collection are possible after code execution
  • User-context compromise can expose documents, browser/session data, and enterprise secrets
  • Follow-on tooling can expand data exfiltration scope across connected services
  • Malware/ransomware execution may disrupt system and business operations
  • Incident response, isolation, and remediation can cause productivity downtime
  • Lateral movement attempts can increase broader operational impact in enterprise networks

Mitigation Strategies

Immediate Actions

  • Update immediately to 7-Zip version 26.02 or later
  • Block and quarantine suspicious archive attachments from untrusted sources
  • Scan downloaded archives with antivirus and sandbox controls before extraction

Short-term Measures

  • Enforce least-privilege user operation and avoid admin accounts for daily tasks
  • Strengthen email filtering and attachment inspection for compressed file payloads
  • Restrict execution of suspicious child processes launched post-extraction

Resources and References

Public Reporting

Last Updated: July 19, 2026