CVE-2026-14266
7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability
HIGH 7.8EPSS 0.7%
7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of XZ chunked data. Crafted XZ-compressed data can trigger an overflow of a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30169.
- Affected
- 7-Zip
- CVSS v3.1 NVD
- 7.8 HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS v3.0 TRENDMICRO
- 7.0 HIGH
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - EPSS
- 0.74% chance of exploitation in the next 30 days, 54th percentile
- Published
- 2026-07-29
- Updated
- 2026-07-30
Proof-of-concept exploits (2)
- 4minx/CVE-2026-142664★ · 2026-08-15
- ret2bilibili/CVE-2026-142660★ · 2026-07-17
Security advisories
- http://www.openwall.com/lists/oss-security/2026/07/17/12
- https://www.zerodayinitiative.com/advisories/ZDI-26-444