CVE-2026-14266

Published Jul 29, 2026

Last updated a month ago

CVSS high 7.8
7-Zip

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-14266 is a heap-based buffer overflow vulnerability found in 7-Zip, a widely used open-source file archiving tool. The flaw specifically arises from the improper handling of XZ chunked data during the decompression process. When 7-Zip processes specially crafted XZ-compressed data, it can trigger a memory corruption where data written to a buffer exceeds its allocated space. This vulnerability allows remote attackers to execute arbitrary code on affected systems. For exploitation, user interaction is required; a target must either open a maliciously crafted archive file or visit a malicious webpage designed to deliver the crafted XZ payload. Successful exploitation results in the execution of malicious code with the privileges of the logged-in user running 7-Zip. The issue has been addressed in 7-Zip version 26.02.

Description
7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of XZ chunked data. Crafted XZ-compressed data can trigger an overflow of a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30169.
Source
zdi-disclosures@trendmicro.com
NVD status
Analyzed
Products
7-zip

Risk scores

CVSS 3.1

Type
Primary
Base score
7.8
Impact score
5.9
Exploitability score
1.8
Vector string
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity
HIGH

CVSS 3.0

Type
Secondary
Base score
7
Impact score
5.9
Exploitability score
1
Vector string
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity
HIGH

Weaknesses

zdi-disclosures@trendmicro.com
CWE-122

Social media

Hype score
Not currently trending

  1. Update 7-Zip Now: CVE-2026-14266 Lets Attackers Run Code on Your PC #Cve #Update7ZipNow #Tech @CallofDuty https://t.co/hGbmbFwP3p

    @HappyGamerNews

    25 Jul 2026

    45 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. For defenders, 7-zip cve-2026-14266 turns archive handling into an endpoint pa… should move fast. ZDI disclosed CVE-2026-14266, a 7-Zip XZ decoder heap overflow fixed in 26.02 that can enab… 🔗 Details → https://t.co/AMysRhb3Ya

    @SocXAInvaders

    21 Jul 2026

    3 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. ⚠️7-Zipがリモートコード実行の脆弱性を修正（CVE-2026-14266） 🚨WP2Shell脆弱性、攻撃で悪用されるように：CVE-2026-60137、CVE-2026-63030 〜サイバーセキュリティ週末の話題〜 https://t.co/bnTLCvEBEb

    @MachinaRecord

    21 Jul 2026

    204 Impressions

    1 Retweet

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  4. 7-Zipに今年2件目のリモートコード実行脆弱性（CVE-2026-14266）が見つかった。CVSS 7.0。 XZ形式の圧縮データを展開する処理にヒープベースのバッファオーバーフローがあり、細工されたファイルを開くと任意コ

    @joho_no_todai

    19 Jul 2026

    4297 Impressions

    29 Retweets

    68 Likes

    14 Bookmarks

    1 Reply

    0 Quotes

  5. Wordpress祭り中だけど、7-zip、こっちも地味に継続中。悪性書庫を開くだけのRCEは、さすがに放置できない。7-ZipはCVE-2026-14266を26.02で修正。細工したXZ chunked dataでheap-based buffer

    @connect24h

    19 Jul 2026

    1232 Impressions

    3 Retweets

    19 Likes

    9 Bookmarks

    1 Reply

    0 Quotes

Configurations

Related CVEs

  1. 7-Zip for Windows through 26.01 fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive, because its guard that suppresses an archive-supplied Zone.Identifier stream matches the exact name 'Zone.Identifier' while a RAR5 STM record named ':Zone.Identifier:$DATA' is not matched and NTFS canonicalizes it to the same stream, overwriting the propagated Internet-zone marker with ZoneId=0. A second STM record named '::$DATA' overwrites the extracted file's default data stream, letting an attacker defeat SmartScreen/MotW warnings and spoof file content.•CVE-2026-58052
  2. 7-Zip is a file archiver with a high compression ratio. Versions 9.18 through 26.00 contain a heap out-of-bounds read in 7-Zip Ar handler BSD SYMDEF parser. A 4-byte heap out-of-bounds read exists in the Unix ar archive parser in 7-Zip. When parsing a BSD-style __.SYMDEF symbol table, the ParseLibSymbols function reads a 32-bit namesSize field via Get32 at a position that can equal the buffer size, reading 4 bytes past the end of the heap allocation. This reads uninitialized heap data under the default allocator. Version 26.01 patches the issue.•CVE-2026-48112
  3. 7-Zip is a file archiver with a high compression ratio. Versions 9.34 through 26.00 contain an off-by-one heap out-of-bounds read in the WIM (Windows Imaging) archive handler's security descriptor lookup. In CHandler::GetSecurity (CPP/7zip/Archive/Wim/WimHandler.cpp), the per-image SecurOffsets table holds numEntries + 1 cumulative offsets, but the check securityId >= SecurOffsets.Size() admits securityId == numEntries, and the function then reads SecurOffsets[securityId + 1], fetching one UInt32 past the end of the heap-allocated CRecordVector (which performs no bounds checking on operator[]). The securityId is attacker-controlled at offset +0xC of any directory entry in WIM metadata, and the handler is registered for .wim, .swm, .esd, and .ppkg and enabled by default in stock 7z.dll; the OOB triggers zero-click in the GUI because 7zFM.exe's ListView calls GetRawProp(kpidNtSecure) for every item during listing (ASan-confirmed), and is also reachable via CLI listing with 7zz l -slt. Impact is limited to denial of service under hardened allocators and minor information disclosure, since the OOB value is only consumed arithmetically as a length and is not surfaced to the attacker; there is no write primitive.•CVE-2026-48103
  4. 7-Zip is a file archiver with a high compression ratio. Versions 9.21 through 26.00 contain an off-by-one out-of-bounds read vulnerability in the ParseDepedencyExpression function of the UEFI firmware image parser(CPP/7zip/Archive/UefiHandler.cpp). The function validates an attacker-controlled opcode byte using > instead of >= against the element count of the 10-entry kExpressionCommands static array, allowing an opcode value of 10 to read one pointer slot (8 bytes on x64) past the end of the array in .rodata. The out-of-bounds value is then dereferenced as a const char * and passed through strlen and memcpy into the archive's Characts property, which may cause either a denial of service (access violation when the adjacent bytes do not form a valid readable pointer) or a minor information disclosure of an adjacent .rdata string literal into archive metadata. The vulnerability is reached automatically during IInArchive::Open() via the call path OpenFv/OpenCapsule → ParseVolume → ParseSections when processing a SECTION_DXE_DEPEX (0x13) or SECTION_PEI_DEPEX (0x1B) section whose first body byte is 0x0A, and the UEFI handler is enabled by default in stock 7z.dll with signature-based detection for both UEFIc and UEFIf formats. The outcome (crash vs. silent leak) is deterministic per build but linker-layout dependent, with no write primitive and no disclosure of heap data, secrets, or ASLR base addresses. Version 26.01 fixes the issue.•CVE-2026-48111
  5. 7-Zip is a file archiver with a high compression ratio. Versions 9.18 through 26.00 contain an uninitialized heap read in the SquashFS archive handler caused by a sparsely populated index array. In the SquashFS handler, _blockToNode is allocated with capacity for every metadata block but populated only when an inode crosses a block boundary, so a crafted image with few inodes spanning many blocks leaves most slots holding raw heap contents (the underlying allocator does not zero-initialize POD storage). When OpenDir looks up an attacker-influenced blockIndex (derived from the RootInode superblock field), it reads two of these uninitialized slots and passes them as the left/right bounds of a binary search over _nodesPos, which dereferences the midpoint without bounds checking; if the resulting value happens to match the search key, the returned index is used to read a full node struct from _nodes whose fields feed further directory parsing, forming a chained OOB read primitive that is heap-layout-dependent and not reliably triggerable. The SquashFS handler is enabled by default in stock 7z.dll and the issue triggers during Open() with no interaction beyond opening the file; impact is denial of service from wild-pointer dereference and potential heap information disclosure, with no write primitive. Version 26.01 fixes the issue.•CVE-2026-48104

References

Sources include official advisories and independent security research.