A critical heap-based buffer overflow in 7-Zip, the world's most widely used open-source file archiver, allows remote code execution when users open specially crafted XZ-compressed archives. Tracked as CVE-2026-14266, the flaw was disclosed on July 17, 2026, and affects all 7-Zip versions prior to 26.02.

What Happened

The vulnerability resides in 7-Zip's handling of XZ chunked data streams during decompression. XZ is a compression format that organizes data into blocks and chunks, each carrying metadata for reconstruction. Insufficient validation of chunk data allows an attacker to craft input that overflows a heap-allocated buffer during processing, corrupting adjacent memory structures and potentially hijacking program execution flow.

According to the Zero Day Initiative advisory ZDI-26-444, the flaw was discovered and reported by Landon Peng of Lunbun LLC. While exploitation requires user interaction (the victim must open the malicious archive), the attack vector is trivial: email attachments, downloaded files, or compromised websites serving malicious XZ archives.

Technical Details

Root Cause: Heap Buffer Overflow in XZ Chunk Parser

The 7-Zip XZ decoder allocates a heap buffer for processing chunk metadata. When parsing chunk headers, the code fails to validate that the declared chunk size matches the actual data available. A maliciously crafted XZ archive can specify an oversized chunk, causing the parser to write beyond the allocated buffer boundary.

Exploitation Path

1. Attacker creates malicious XZ archive with oversized chunk headers
2. Delivers via phishing email, compromised download, or drive-by download
3. Victim opens archive in 7-Zip (double-click, right-click → Extract, or CLI)
4. 7-Zip's XZ decoder processes chunk headers → heap overflow
5. Attacker gains code execution in context of user running 7-Zip

Impact Assessment

Factor	Rating	Notes
CVSS 3.1 Base Score	9.8 (Critical)	AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector	Network	Malicious file delivered over network
Attack Complexity	Low	Standard archive opening
Privileges Required	None	User-level execution
User Interaction	Required	Must open archive
Scope	Unchanged	Local process
Confidentiality	High	Full user data access
Integrity	High	Arbitrary code execution
Availability	High	Process crash / system compromise

Note: The "User Interaction Required" (UI:R) modifier reduces the score from 9.8 to 8.8 (High) in CVSS 4.0, but the practical risk remains severe given how routinely users open archives.

Affected Versions

Product	Affected Versions	Fixed Version
7-Zip (Windows)	< 26.02	26.02+
p7zip (Linux/macOS)	< 17.04	17.04+
7-Zip ZS (fork)	All versions	Update from upstream

Check your version: 7z --version or Help → About in GUI.

Mitigation & Patching

Immediate Actions

1. Update to 7-Zip 26.02 or later immediately

   • Windows: Download from 7-zip.org
   • Linux: sudo apt update && sudo apt install p7zip-full (or distro equivalent)
   • macOS: brew upgrade p7zip or use Keka (which bundles 7-Zip)

2. Verify the fix: 7z --version should show 26.02+

3. Deploy via software management (SCCM, Intune, Chocolatey, winget):

   powershell

Network & Email Defenses

• Block .xz attachments at email gateway (or scan with sandbox)
• Configure web proxy to inspect/scan archive downloads
• Deploy EDR rules monitoring 7z.exe / 7zFM.exe for:
  • Spawning child processes (cmd.exe, powershell.exe, wscript.exe)
  • Network connections from 7-Zip process
  • Memory allocation anomalies (heap spray patterns)

User Awareness

• Do not open unexpected archives from unknown senders
• Verify file extensions: .xz, .tar.xz, .7z can all contain XZ data
• Use "Extract to folder" instead of double-click to inspect contents first

Detection Guidance

YARA Rule: Malicious XZ Chunk Overflow

Sigma Rule: 7-Zip Spawning Suspicious Children

Network IOCs

• No specific C2 indicators — this is a local exploit
• Watch for post-exploitation traffic from compromised host
• Monitor for 7-Zip processes making outbound connections (never legitimate)

Frequently Asked Questions

Q: Does this affect .7z files or only .xz/.tar.xz?

A: The vulnerability is in the XZ decoder. Any archive format that uses XZ compression internally is affected: .xz, .tar.xz, .txz. Pure .7z files (LZMA/LZMA2) are not affected unless they contain an embedded XZ stream (rare).

Q: Is the Windows Explorer preview pane vulnerable?

A: If you have the 7-Zip shell extension installed, yes — previewing a malicious .xz file in Explorer triggers the decoder. Disable preview pane for archive types or uninstall shell extension until patched.

Q: Does this affect other tools that use 7-Zip's code (PeaZip, Keka, etc.)?

A: Yes. Any application bundling the vulnerable 7-Zip XZ decoder is affected. Check vendor advisories for PeaZip, Keka, Bandizip, NanaZip, and similar tools.

Q: Can this be exploited via web browsers?

A: Only if the browser hands off .xz files to 7-Zip (via registered handler). Most browsers download and prompt; they don't auto-extract. Risk is low but non-zero.

Q: Has this been exploited in the wild?

A: As of July 17, 2026, no public reports of active exploitation. ZDI typically coordinates disclosure with vendor patch availability. However, the exploit is straightforward — weaponization is expected within days.

Q: Why is the CVSS score 9.8 if user interaction is required?

A: CVSS 3.1 scores Network/Low/None/Required as 9.8. The "User Interaction" metric only reduces to 8.8 in CVSS 4.0. Regardless, treat as Critical.

Key Takeaways

1. Patch 7-Zip to 26.02+ today — this is a Critical RCE in the world's most popular archiver
2. User interaction required but trivial — phishing with .xz attachments is a proven vector
3. Heap overflows are reliably exploitable — modern mitigations (ASLR, DEP, CFG) raise the bar but don't prevent RCE
4. Supply chain risk — many tools bundle 7-Zip; audit your software inventory
5. Detection is feasible — YARA for malicious archives, Sigma for post-exploitation behavior

Conclusion

CVE-2026-14266 is a textbook critical vulnerability in ubiquitous software: a heap buffer overflow in a parser for a common file format, reachable via routine user action (opening an archive). While the "user interaction required" caveat prevents wormable spread, the attack surface is massive — every desktop, laptop, and server with 7-Zip installed. Organizations should prioritize this patch alongside browser and OS updates, deploy email/web gateway scanning for .xz files, and add detection rules for post-exploitation activity originating from 7-Zip processes.

---

Sources:

• Zero Day Initiative: ZDI-26-444
• 7-Zip 26.02 Release Notes
• CyberPress: Critical 7-Zip XZ Vulnerability Allows Remote Code Execution