PT-2026-60346 · 7 Zip · 7-Zip

CVE-2026-14266 · Published 2026-07-15 · Updated 2026-07-17

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions 7-Zip versions prior to 26.02

Description A flaw in the processing of XZ chunked data allows remote attackers to execute arbitrary code in the context of the current process. The issue occurs when the software processes specially crafted XZ-compressed data streams, triggering a heap-based buffer overflow. A heap-based buffer overflow is a memory corruption issue that happens when data written to a buffer exceeds its allocated space. Exploitation requires user interaction, such as opening a malicious archive file or visiting a malicious page.

Recommendations Update to version 26.02. Avoid opening compressed files from untrusted sources.

Related Identifiers

CVE-2026-14266

ZDI-26-444

Affected Products

7-Zip

References · 11

• https://zerodayinitiative.com/advisories/ZDI-26-444 · Security Note
• https://twitter.com/Techsico_IT/status/2078073108292878844 · Twitter Post
• https://twitter.com/ThreatWire_/status/2077793920864362546 · Twitter Post
• https://twitter.com/blackorbird/status/2078136213194826142 · Twitter Post
• https://thecybersecguru.com/news/7-zip-vulnerability-cve-2026-14266 · Reddit Post
• https://twitter.com/pillitterip/status/2078091476035092731 · Twitter Post
• https://twitter.com/ng_thanh8/status/2078069818062999965 · Twitter Post
• https://twitter.com/thecybersecguru/status/2077987214638891168 · Twitter Post
• https://twitter.com/The_Cyber_News/status/2077948864632615092 · Twitter Post
• https://twitter.com/techpio_team/status/2078143982903656480 · Twitter Post
• https://twitter.com/Daily_CyberSec/status/2077793725644775710 · Twitter Post