7-Zip security alert fixes XZ buffer overflow that could run code when opening malicious files with version 26.02

A buffer overflow on the 7-Zip XZ handle allows you to run code if a user opens a malicious file, but does not automatically convert that execution into high privileges: the correction came in version 26.02 published on June 25 and should be applied as soon as possible.

Vulnerability, recorded as CVE-2026-14266, was reported to 7-Zip on June 5 by Landon Peng (Lunbun LLC) and detailed by Trend Micro / ZDI on July 15. In technical terms, the XZ decoder miscalculated the space available when applying output filters and in some scenarios wrote out of the assigned buffer; the applied repair subtract the already written bytes and aborts if the total exceeds the space, avoiding the overwritten that allowed the error condition.

It is important to understand the real risk: the execution occurs in the context of the 7-Zip process, so it does not automatically raise privileges. In Windows, 7-Zip released normally runs with a standard user-filtered token even in administrative accounts, so the operator code inherits those limited permissions unless the application is run high. ZDI pointed out the failure with a CVSS that reflects local vector and high complexity (AV: L / AC: H / PR: N / IU: R / S: U / C: H / I: H / A: H), which means that an attacker must get the victim to open the affected file - for example, send it by mail, download or web - and the reliable operation is not trivial.

The June correction was applied to a single decoder function (MixCoder _ Code in XzDec.c) and, according to public analysis, the same mismanagement of lengths was present in the 7-Zip source code from at least version 21.07 (2021). Although vulnerability is not remote in the sense of "without interaction," it does support remote delivery vectors if the file reaches the end user; therefore its abuse potential depends a lot on social engineering and the software deployment context.

While no public evidence of concept or credible reports of wild-state exploitation has been found to date indicated in the report, the situation should not be underestimated: 7-Zip has had several security vulnerabilities in 2026 and version 26.02 consolidates previous corrections (including management failures of NTFS with higher score). This is why the most direct and effective preventive measure is to update the facilities.

What to do now: manually install 7-Zip 26.02 or later from the official site and apply it to all machines that open files received from external sources; updates are not always automatically deployed. If your organization distributes a copy of the XZ codec to third-party products, it requires those suppliers to integrate the arrangement. While applying the patch, reduce the risk by avoiding opening XZ files from unverified shipping, blocking unnecessary file types in mail and browser controls, and strengthening application policies and antivirus in endpoints.

For response teams and administrators, in addition to deploying the update, it is appropriate to audit telemetric in endpoints for search of 7-Zip processes executed in unusual contexts and to review supply chains that integrate 7-Zip components to coordinate patches with suppliers. Maintain the minimum privilege rule and avoid running archiving tools with unnecessary lifting reduces the potential impact of these failures.

More information and downloads on the official website of 7-Zip and the registration of the EVC at the NVD base: CVE-2026-14266 (NVD). For similar research and security audits in common components, see GitHub Security Lab resources in GitHub Security Lab.