A heap-based buffer overflow in 7-Zip allows attackers to execute arbitrary code when users extract crafted XZ archives. The vulnerability, tracked as CVE-2026-14266, exists in the archiver's handling of XZ chunked data compression.
Trend Micro's Zero Day Initiative disclosed the flaw on July 15. The vulnerability enables remote code execution within the privileges of the user running 7-Zip, meaning an attacker could gain system access by distributing a malicious XZ archive through email, file-sharing platforms, or compromised websites.
7-Zip addressed the issue in version 26.02, released June 25. Users running older versions face active risk. The attack requires no user interaction beyond extracting the archive. An attacker does not need credentials or network access to the target system. A single malicious file triggers code execution during the normal extraction process.
For organisations, this threatens any systems where users extract untrusted archives. Development environments, file-sharing services, and backup systems face heightened exposure. The vulnerability affects users across Windows, macOS, and Linux distributions where 7-Zip runs.
Security teams should prioritize patching 7-Zip to version 26.02 or later immediately. Users should avoid extracting archives from unknown sources pending updates. Network monitoring should flag unusual child processes spawned by 7-Zip, though this provides only partial detection coverage.
The timing between the fix and public disclosure suggests a coordinated responsible disclosure process. However, the window between the June 25 patch and the July 15 public disclosure allowed sufficient time for exploitation attempts in the wild. ZDI publication details increase exploitation ease for threat actors lacking the original exploit code.
7-Zip remains widely installed across enterprise infrastructure, making this vulnerability relevant to most organisations. Users who cannot immediately patch should consider disabling automatic archive