New 7-Zip Vulnerability Could Let Crafted XZ Archives Run Code During Extraction
Summary
A critical heap-based buffer overflow vulnerability, CVE-2026-14266, has been discovered in 7-Zip. This flaw allows attackers to execute code during the extraction of specially crafted XZ archives. A fix was released in 7-Zip version 26.02 on June 25th.
IFF Assessment
FOE
This vulnerability allows attackers to execute arbitrary code on a victim's machine, posing a significant risk to defenders.
Severity
7.8
High
Defender Context
Defenders should prioritize patching their 7-Zip installations to the latest version (26.02 or later) to mitigate the risk of this critical vulnerability. Users should also be cautious about opening XZ archives from untrusted sources, as this could trigger code execution.