# 7-Zip XZ Handler Heap Overflow Lets Crafted Archives Execute Code on Extraction
## The Threat
A heap-based buffer overflow in 7-Zip's XZ archive decoder can let an attacker execute code on the victim's machine with the privileges of the 7-Zip process itself. The flaw, CVE-2026-14266, was reported to the 7-Zip maintainer on June 5 by Landon Peng of Lunbun LLC, patched on June 25 in version 26.02, and publicly detailed by Trend Micro's Zero Day Initiative on July 15.
The bug lives in MixCoder_Code inside C/XzDec.c. When an XZ stream pipes its output through a filter chain, 7-Zip was passing the full output-buffer size on every decode pass — instead of the space that remained after previous writes. That accounting error is the classic precondition for a heap write-out-of-bounds: the decoder believes it has more room than the buffer actually holds. The fix in 26.02 subtracts already-written bytes and aborts if the running total ever exceeds the buffer limit. The vulnerable length-handling logic appears unchanged going back to at least version 21.07 from 2021, though neither ZDI nor 7-Zip has pinpointed exactly which earlier releases are reliably exploitable.
Exploitation requires a user to open a crafted XZ file — via email attachment, browser download, or any other delivery path that gets the file in front of 7-Zip. On Windows, a standard 7-Zip launch runs under a filtered user token even for administrator accounts, so a successful attack inherits limited rights unless the user launched 7-Zip elevated. No public proof-of-concept exists as of July 20, 2026, and there are no credible reports of in-the-wild exploitation.
## Severity and Impact
| Field | Detail |
|---|---|
| CVE | CVE-2026-14266 |
| CVSS Score | 7.0 (High) |
| CVSS Vector | AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H |
| CWE | CWE-122 (Heap-based Buffer Overflow) |
| Attack Vector | Local (file must be opened by the victim) |
| Attack Complexity | High |
| Privileges Required | None |
| User Interaction | Required |
| Scope | Unchanged |
| Impact (C/I/A) | High / High / High |
The High attack complexity is meaningful here — reliable exploitation is not trivial. The local attack vector is often misread: it does not require the attacker to be physically local; it means the payload file must execute on the local system, delivered by any remote channel but opened by the user.
## Affected Products
## Mitigations
Update immediately to 7-Zip 26.02 or later. This release consolidates all memory-safety fixes from the recent patch cycle, including the higher-severity CVE-2026-48095 fixed in 26.01. There is no network-accessible attack surface to block at the perimeter — the fix must go on the endpoint.
Practical steps for organizations:
The 20-day gap between patch and advisory means any organization that updated in late June is already ahead of any potential exploitation wave triggered by the public disclosure.
## References
---
## HackWire Analysis
What this story really illustrates is the compounding debt of C-based archive parsing code. 7-Zip's XZ decoder has carried this off-by-one length accounting error since at least 2021 — five years of archive opens, across billions of files, with a quietly wrong size calculation running underneath. The code wasn't obviously broken; it worked correctly for every well-formed archive and only blew up when a crafted stream deliberately exercised the edge case. That's how these bugs survive: they're invisible until someone goes looking.
The timing relative to CVE-2026-48095 is worth attention. That NTFS-handler flaw scored higher and came with a working proof-of-concept from GitHub Security Lab less than four weeks after the 26.01 fix. The XZ flaw is quieter — no PoC, lower CVSS, higher attack complexity — but it follows the same pattern: a memory-safety bug in a format handler, in code that hasn't been significantly modernized. When a security researcher starts pulling threads on a codebase, they rarely find just one.
The embedded-copy problem is underappreciated here. 7-Zip is not just a standalone desktop application; it is a library that gets bundled into installers, deployment tools, backup agents, and enterprise software packages. Vendors who ship their own copy of the XZ decoder are independently vulnerable and need to ship their own patch. That population is large and poorly tracked — most organizations have no inventory of which of their tools embed 7-Zip internally. The patch to 26.02 is straightforward; knowing *where* you need it is the harder problem.
Defenders should prioritize the inventory question over the patch itself. The standalone 7-Zip update is a five-minute job. Finding every piece of software in your estate that vendors the decoder is where the real work lives.
— HackWire Editorial
---
## Related Coverage