Overview
- Security researchers reported a heap-based buffer overflow in 7‑Zip’s XZ decoder that can write past the output buffer and let a crafted XZ archive execute code inside the 7‑Zip process.
- The bug stems from MixCoder_Code in C/XzDec.c where the decoder incorrectly assumed the full output buffer was available on each decompression pass, causing an out-of-bounds write.
- 7‑Zip issued version 26.02 to fix the flaw, and that patch was released on June 25, 2026, before public advisory details were published.
- Trend Micro’s ZDI assigned CVE‑2026‑14266 a CVSS v3.0 score of 7.0 and said exploitation requires a user to open a malicious XZ file, so attacks rely on delivery methods like phishing or malicious downloads.
- Because 7‑Zip has no auto-update and many products embed its XZ decoder, organizations should install 26.02+, scan or block XZ attachments, verify vendor binaries, and monitor endpoints for unusual archiver process behavior.