7-Zip Fixes CVE-2026-14266 Remote Code Execution Flaw in XZ Parsing

A newly disclosed 7-Zip vulnerability, tracked as CVE-2026-14266, allows remote code execution via a heap-based buffer overflow in the handling of crafted XZ chunked data. An attacker can trigger the flaw if a user opens a malicious archive or is lured to content that delivers a specially crafted XZ payload, causing code to run with the privileges of the current user. The issue is considered significant because 7-Zip is widely deployed and the attack path can be readily paired with phishing or malicious attachments.

The bug was reported by Landon Peng of Lunbun LLC through coordinated disclosure, and the Zero Day Initiative published advisory ZDI-26-444 after the fix became available. 7-Zip version 26.02, released on June 25, 2026, contains the patch, and reporting said no public proof-of-concept or in-the-wild exploitation had been confirmed at publication. The flaw was assigned a CVSS 7.0 score, reflecting the need for user interaction and a relatively complex exploit path, and users were urged to update and avoid opening untrusted compressed files.