A newly disclosed vulnerability in 7-Zip may enable attackers to execute arbitrary code by tricking customers into opening a specifically crafted XZ-compressed file.
Tracked as CVE-2026-14266 and recognized by Development Micro’s Zero Day Initiative as ZDI-26-444 (ZDI-CAN-30169), the flaw is a heap-based buffer overflow within the archive utility’s dealing with of XZ chunked knowledge. The vulnerability was publicly disclosed on July 15, 2026, and impacts 7-Zip installations working variations previous to
The problem lies within the processing of XZ-compressed knowledge, a generally used compression format present in software program packages, backups, distributed archives, and different compressed content material.
In accordance with the advisory, specifically crafted XZ chunked knowledge could cause 7-Zip to write down past the boundaries of a heap-allocated buffer. This reminiscence corruption situation could enable an attacker to realize management of software execution and run arbitrary code throughout the safety context of the present 7-Zip course of.
7-Zip Vulnerability
Profitable exploitation requires person interplay. An attacker would wish to influence a sufferer to open a malicious archive or entry attacker-controlled content material by way of a malicious webpage or obtain course of.
Though this requirement reduces the probability of automated exploitation, it nonetheless poses a big threat in focused phishing, malware supply, and social engineering campaigns.
Menace actors may disguise a malicious file as a reputable archive, software program replace, doc bundle, or shared backup file to trick victims into processing it with 7-Zip.
The vulnerability has been assigned a CVSS rating of seven.0, with the vector AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. This rating displays the native attack-vector necessities and the necessity for person interplay, whereas additionally acknowledging the potential for a whole impression on confidentiality, integrity, and availability following profitable exploitation.
No authentication or present privileges are required, that means {that a} sufferer who merely opens a file might be uncovered, even when the attacker has no prior entry to the focused machine.
Heap-based buffer overflows are notably harmful as a result of they’ll corrupt dynamically allotted reminiscence and doubtlessly redirect program execution.
Relying on the goal setting and exploitation circumstances, an attacker could make the most of the flaw to launch malware, steal knowledge accessible to the present person, modify information, or destabilize the affected system.
Whereas the advisory doesn’t point out that CVE-2026-14266 is actively exploited within the wild, publicly accessible technical particulars could enhance the probability of an exploit being developed.
The vulnerability was reported to 7-Zip on June 5, 2026, by researcher Landon Peng from Lunbun LLC. Following coordinated disclosure, ZDI launched the advisory on July 15, 2026. The problem has been addressed in 7-Zip model 26.0.
Customers and organizations are strongly suggested to replace to 7-Zip model 26.0 or later as quickly as attainable. Safety groups must also monitor for suspicious XZ archives delivered via e mail, messaging platforms, file-sharing providers, or untrusted web sites.
Till updates are deployed, customers ought to keep away from opening surprising compressed information and confirm the sources of archives earlier than extracting or previewing their contents.
 Strengthen Your SOC by Accelerating Menace Detection & Speedy Investigations. -> Combine ANY.RUN With Your SOC Now.
