Overview
- A security researcher from Lunbun LLC reported the flaw to 7‑Zip on June 5 and the project shipped version 26.02 on June 25 to fix the MixCoder_Code output‑buffer logic.
- Trend Micro’s Zero Day Initiative assigned CVE‑2026‑14266 and rated it High with a CVSS v3.0 score of 7.0 because the bug is a heap‑based overflow that can lead to code execution.
- Exploitation requires a victim to open or trigger a crafted XZ file and any code runs with the same privileges as the 7‑Zip process rather than elevating itself.
- As of July 20 there is no public proof‑of‑concept and no confirmed in‑the‑wild exploitation, so installing 7‑Zip 26.02 remains the recommended immediate action.
- The flaw is the latest in a string of memory‑safety bugs in 7‑Zip’s archive handlers, which raises supply‑chain risk for products that embed 7‑Zip’s XZ decoder and means vendors must verify or ship updated binaries.