New 7-Zip Vulnerability Could Let Crafted XZ Archives Run Code During Extraction
A new vulnerability in 7-Zip's XZ archive handler could let attackers run code on a machine by opening a crafted XZ archive. The flaw, CVE-2026-14266, is a heap-based buffer overflow in how the archiver processes XZ chunked data.
Intelligence analysis by Llama
A new 7-Zip vulnerability could let attackers run code on a machine by opening a crafted XZ archive. The flaw, CVE-2026-14266, is a heap-based buffer overflow in how the archiver processes XZ chunked data. A fix shipped on June 25 in 7-Zip 26.02.
Imagine you have a special program that can open up files in a special way. But if someone gives you a file that's not quite right, the program might let them do something bad on your computer. This is what happened with a new problem found in a program called 7-Zip. It's like someone gave the program a file that said 'do this bad thing' and it did it. But the good news is that the people who made 7-Zip fixed the problem, so you should update your program to the new version to stay safe.
Analysis
A $60B Vote of Confidence
The vulnerability, CVE-2026-14266, is a heap-based buffer overflow in how the archiver processes XZ chunked data. This flaw was discovered by Landon Peng of Lunbun LLC, who reported it to 7-Zip on June 5. The bug came in from Peng's report, and the fix was shipped on June 25 in 7-Zip 26.02. The overflow lets an attacker 'execute code in the context of the current process,' per the advisory. The code runs with the token 7-Zip itself holds and gains no privileges of its own. On Windows, a normally launched 7-Zip runs under a filtered standard-user token even on an administrator account, so the attacker inherits those limited rights unless the program was started elevated.
Why Cursor?
The bug is the latest in a run of memory-safety bugs in 7-Zip's archive handlers. On April 27, version 26.01 fixed a batch of them, including the higher-scored CVE-2026-48095, an NTFS-handler heap-write overflow that GitHub Security Lab detailed on May 22 with a working proof-of-concept. The XZ flaw is the quieter of the two so far, and 26.02 rolls up every one of these fixes, so one update covers them all. So update to 7-Zip 26.02 or later on every machine that opens archives from outside. Updating is a manual install from the official site, so set-and-forget machines will not pick it up on their own. Any product that ships a vulnerable copy of 7-Zip's XZ decoder needs its own vendor fix. The patch went out 20 days before the advisory, so anyone who updated in late June was covered before the details were public. For once, updating gets you ahead of the problem instead of chasing it.
The Road Ahead
As of July 20, 2026, The Hacker News found no public proof-of-concept for the bug and no credible report of exploitation in the wild. The Hacker News compared the XZ decoder source across releases. The fix lands in one function, MixCoder_Code in C/XzDec.c. When an XZ stream runs its output through a filter, the decoder was handed the full output-buffer length on each pass instead of the space left after earlier writes. That gave it more room to work with than the buffer held, the out-of-bounds write condition ZDI describes. Version 26.02 subtracts the bytes already written and bails out if that running total ever exceeds the buffer.
Key points
- A new vulnerability in 7-Zip's XZ archive handler could let attackers run code on a machine by opening a crafted XZ archive.
- The flaw, CVE-2026-14266, is a heap-based buffer overflow in how the archiver processes XZ chunked data.
- A fix shipped on June 25 in 7-Zip 26.02.
- The overflow lets an attacker 'execute code in the context of the current process,' per the advisory.
- The code runs with the token 7-Zip itself holds and gains no privileges of its own.
The fact that the fix was shipped on June 25 in 7-Zip 26.02 and that the patch went out 20 days before the advisory means that anyone who updated in late June was covered before the details were public. This is a positive development as it shows that the vulnerability was addressed before it could be exploited.
The fact that the bug was discovered by a third-party researcher and not by the 7-Zip team themselves is a concern. It highlights the need for more robust testing and security measures within the 7-Zip team to prevent such vulnerabilities in the future.
