CVE-2026-14266: 7-Zip Heap Overflow in XZ Parsing Fixed in 26.02

7-Zip has patched a heap-based buffer overflow that could let an attacker run code on a victim's machine simply by getting them to extract a malformed XZ archive. The flaw, tracked as CVE-2026-14266, was reported to the 7-Zip maintainers on 5 June 2026 by researcher Landon Peng of Lunbun LLC, fixed in 7-Zip 26.02 on 25 June, and formally disclosed by Trend Micro's Zero Day Initiative on 15 July as ZDI-26-444.

What the flaw does

The bug sits in MixCoder_Code, part of 7-Zip's XZ chunk decoder in C/XzDec.c. Rather than tracking how much space remained in the output buffer as it processed successive chunks, the decoder repeatedly passed the buffer's *full* length on each pass. A crafted XZ stream with the right chunk structure could push the decoder to write past the end of that heap allocation. Version 26.02 corrects this by subtracting bytes already written before each subsequent write — a straightforward but easy-to-miss bookkeeping error in streaming decompression code.

Who's actually at risk

The CVSS 7.0 score (AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) is worth reading carefully rather than just triaging by number. AV:L and UI:R mean this isn't a network-scannable, zero-click flaw — it requires a user to actually open a malicious XZ archive, which typically means it arrives as an email attachment, a download, or a file dropped via another initial-access vector. Once triggered, code executes in the context of the process handling the extraction, inheriting whatever privileges that user session already has. On Windows, that's meaningfully constrained for standard-user tokens even when the logged-in account has administrator rights — a real mitigating factor, not a guarantee.

Why the timing matters

The gap between the 25 June patch and the 15 July advisory is a normal coordinated-disclosure window, but it means environments that don't track vendor changelogs independently of security advisories were exposed for roughly three weeks without knowing there was anything to prioritize. As of 20 July, there's no public proof-of-concept and no credible report of exploitation in the wild — but XZ/archive-parsing bugs are attractive to attackers precisely because archive files are routinely allowed through mail and web filters that would block an executable outright.

What to do now

• Update 7-Zip to 26.02 or later across endpoints, build servers, and any automation that shells out to 7z/7za for extraction.
• Inventory where 7-Zip is bundled inside other tools (installers, CI images, forensic/IR toolkits) — version drift there is easy to miss.
• Treat inbound XZ/7z archives from untrusted sources the same as any other untrusted executable content in mail and download filtering.
• If you can't patch immediately, avoid extracting archives from unauthenticated or low-trust sources with 7-Zip until you can.

This is a routine patch-and-move-on advisory rather than an emergency, but it's a useful reminder that archive utilities — 7-Zip, unzip, tar implementations — sit on a lot of attack surface precisely because they're treated as boring infrastructure rather than parsers of untrusted, attacker-controlled input.