News › security
By Zayden R., July 20, 2026
A newly discovered 7-Zip vulnerability, CVE-2026-14266, could allow code execution through crafted XZ archives. The flaw, a heap-based buffer overflow, was detailed by Trend Micro's ZDI. A fix is available in 7-Zip 26.02.
In a concerning development for users of the popular file archiver, 7-Zip, a vulnerability has been identified that could allow malicious actors to execute code on a target machine. The flaw, designated CVE-2026-14266, is a heap-based buffer overflow affecting how 7-Zip processes XZ chunked data. This was disclosed by Trend Micro's Zero Day Initiative (ZDI) on July 15.
The vulnerability is particularly troubling because it can be triggered simply by opening a specially crafted XZ archive, allowing for code execution in the context of the current process. This could potentially lead to unauthorized access or control over the affected system. Fortunately, the developers of 7-Zip have been swift in their response, releasing a fix in version 26.02 as of June 25.
This update underscores the importance of keeping software up to date, especially for tools that handle file compression and extraction, which are ubiquitous in many workflows. System administrators and users should ensure they upgrade to the latest version to mitigate any potential risks associated with this flaw.
While 7-Zip has long been a favorite among open-source enthusiasts for its efficiency and versatility, this incident serves as a reminder of the ongoing security challenges faced by even the most trusted software. As always, vigilance and prompt updates are key to maintaining system security.