CVE-2026-14266

Name of the Vulnerable Software and Affected Versions 7-Zip versions prior to 26.02

Description A heap-based buffer overflow exists in the XZ decompression path when processing XZ chunked data. This memory corruption issue occurs because the software fails to perform proper boundary checks, allowing specially crafted XZ data to write beyond the allocated output buffer. Specifically, the MixCoder Code() function within the XzDec.c file continues to use the full buffer size without subtracting the space already filled, resulting in an out-of-bounds write. An attacker can exploit this by enticing a user to open a malicious XZ archive delivered via email, downloads, or a webpage. Successful exploitation allows for arbitrary code execution in the context of the current process. On Windows, the code typically runs under a filtered standard-user token unless the application was started with elevated privileges.

Recommendations Update 7-Zip to version 26.02 or later.