What Happened
On July 20 2026 the security community reported a critical heap‑based buffer overflow in the open‑source archiver 7‑Zip. The flaw, identified as CVE‑2026‑14266, resides in the XZ archive decoder. When a user opens a specially crafted XZ file, the decoder writes beyond the allocated output buffer, giving an attacker the ability to execute arbitrary code in the context of the 7‑Zip process.
Technical Analysis
The vulnerability originates in the MixCoder_Code function within C/XzDec.c. The decoder incorrectly assumes the full output buffer size is available on each decompression pass, rather than calculating the remaining space after previous writes. This miscalculation leads to an out‑of‑bounds write and a heap overflow. 7‑Zip versions from 21.07 through 26.01 are affected. The issue was discovered by researcher Landon Peng of Lunbun LLC and reported to the project on June 5 2026. The Zero Day Initiative (ZDI) assigned a CVSS v3.0 score of 7.0 (High) and classified the attack vector as local – requiring user interaction to open the malicious XZ archive. The exploit does not require elevated privileges; the code executes with the same rights as the user running 7‑Zip, typically a filtered standard‑user token on Windows.
