A critical heap-based buffer overflow vulnerability in 7-Zip, the widely used open-source file archiver, has been disclosed and patched, but unpatched systems remain at risk of remote attacker-driven code execution.
Tracked as CVE-2026-14266, the flaw exists in 7-Zip’s handling of XZ chunked data during decompression: specifically, maliciously crafted XZ-compressed input can trigger a heap overflow when the application parses chunk metadata and allocates buffers without sufficient validation.
According to advisory details from the Zero Day Initiative (ZDI) and the researcher who reported the issue, insufficient checks on chunk sizes and related fields permit an attacker to craft an archive that causes a heap-allocated buffer to be overrun, corrupting adjacent memory structures.
Critical 7‑Zip XZ Heap Overflow
This corruption can then be manipulated to alter control flow and execute arbitrary code in the context of the process handling the file.
While the vulnerability carries a critical severity rating due to its potential for remote code execution, exploitation requires user interaction, an attacker must convince a target to open a specially crafted archive or visit a webpage that triggers 7-Zip to process the malicious XZ data, so the immediate risk is tempered compared with zero-click flaws.
Nevertheless, the user-interaction requirement does not substantially reduce the real-world danger because compressed archives are a common delivery mechanism in phishing campaigns, software package distribution, and shared file systems.
A convincing lure in an email, download, or shared link could successfully induce the needed action. The practical consequences of a successful exploit are severe: code executed under the privileges of the user running 7-Zip could install malware, establish persistence, exfiltrate sensitive data, or enable lateral movement within corporate networks.
In deployed environments where 7-Zip runs with elevated privileges or where users routinely open archives on file servers or via network shares, the impact multiplies.
The vulnerability affects 7-Zip versions prior to 26.02; the project released version 26.02 addressing the XZ chunk-processing logic, and users should update immediately to that version or later.
Organizations should treat this as a high-priority remediation item, incorporating the update into patch management workflows and verifying that endpoints and servers running 7-Zip are upgraded.
In addition to patching, security teams should harden defenses by restricting the handling of untrusted archives: enforce email attachment filtering and sandboxing for archive previews, block or scrutinize downloads from untrusted sources, enable endpoint protections capable of detecting anomalous behaviors tied to archive processing, and educate users about the risks of opening unsolicited compressed files.
The vulnerability was discovered by Landon Peng of Lunbun LLC, whose research detailed how malformed XZ chunk metadata can bypass existing validation and lead to heap corruption; ZDI published coordinated advisory information that includes technical background to help defenders understand the attack surface.
Given 7-Zip’s prevalence in both consumer and enterprise contexts, and its frequent use in automated workflows that process archives without additional sanitization, remaining unpatched systems present attractive targets for phishing and supply-chain style attacks.
Administrators should prioritize review of systems that automatically extract archives, apply the 26.02 update, and monitor for indicators of compromise such as unexpected child processes spawned from archive-handling utilities or anomalous network connections following archive interactions.
No Comment! Be the first one.