- A critical heap-based buffer overflow vulnerability, tracked as CVE-2026-14266, was discovered in 7-Zip’s XZ archive handler.
- An attacker could achieve remote code execution by tricking a user into opening a crafted XZ archive, though the attack requires local user interaction and high complexity.
- 7-Zip patched the flaw in version 26.02 on June 25, twenty days before the advisory was published by Trend Micro’s Zero Day Initiative.
A critical heap-based buffer overflow vulnerability in 7-Zip’s XZ archive handler could allow an attacker to execute arbitrary code on a victim’s machine, according to a detailed advisory published July 15 by Trend Micro’s Zero Day Initiative (ZDI). The flaw, tracked as CVE-2026-14266, resides in how the archiver processes XZ chunked data and was reported to 7-Zip by researcher Landon Peng on June 5.
The exploit occurs when a victim opens a specially crafted XZ file, allowing the attacker to “execute code in the context of the current process,” as described in the advisory. ZDI rates the vulnerability a 7.0 on the CVSS scale, classifying it as High severity with a vector that requires local access and user interaction.
The bug originates in the MixCoder_Code function within the XZ decoder’s source code. The decoder was mistakenly handed the full output-buffer length on each pass instead of the remaining space, leading to an out-of-bounds write condition that version 26.02 patched on June 25 by correctly subtracting bytes already written.
Same flawed length handling has existed in the 7-Zip source code since at least version 21.07 (2021), though it remains unclear which specific releases are actually exploitable. This marks the latest in a series of memory-safety issues for the archiver, following CVE-2026-48095, an NTFS-handler overflow that GitHub Security Lab disclosed with a working proof-of-concept on May 22.
Users must manually install the update from the official site, as the software does not update automatically. The patch shipped twenty days before the public advisory, giving diligent users a head start on mitigation.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
Previous Articles:
- HSBC lifts Apple price target to $366, highest on Wall Street
- Musk calls Foxconn SpaceX server deal fake news; Dell, Super Micro recover.
- South Korea eyes September launch for second phase of CBDC pilot
- Hugging Face Hacked by Autonomous AI Agent System
- Allbridge Core pauses protocol after $1.65M security exploit
