New 7-Zip Vulnerability Could Let Crafted XZ Archives Run Code During Extraction
Summary
A critical heap-based buffer overflow vulnerability, CVE-2026-14266, has been discovered in 7-Zip. This flaw allows attackers to execute code during the extraction of specially crafted XZ archives. A fix was released in 7-Zip version 26.02 on June 25th.
IFF Assessment
This vulnerability allows attackers to execute arbitrary code on a victim's machine, posing a significant risk to defenders.
Severity
The vulnerability is a heap-based buffer overflow, which can lead to remote code execution (CVSS 9.8 - Critical). The exploit vector is through a crafted XZ archive during extraction, and the impact includes complete compromise of the affected process's confidentiality, integrity, and availability.
Defender Context
Defenders should prioritize patching their 7-Zip installations to the latest version (26.02 or later) to mitigate the risk of this critical vulnerability. Users should also be cautious about opening XZ archives from untrusted sources, as this could trigger code execution.