CVE-2026-14266: 7-Zip Heap-Based Buffer Overflow in XZ Chunk Handling Enables Arbitrary Code Execution — Threadlinqs Intelligence
As of 2026-07-21, CVE-2026-14266: 7-Zip Heap-Based Buffer Overflow in XZ Chunk Handling Enables Arbitrary Code Execution is a high-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 31 indicators of compromise.
Threat ID: TL-2026-1428 · Severity: HIGH · CVSS: 7 · Status: PATCHED · Category: VULNERABILITY
Updated: 2026-07-21 · 2 updates · revalidated 2× · latest source
A heap-based buffer overflow in 7-Zip's processing of XZ chunked data (CVE-2026-14266, ZDI-26-444) allows arbitrary code execution in the context of the logged-in user when a victim opens a
CVE-2026-14266 is a memory-corruption vulnerability in 7-Zip's XZ decompression path, specifically in the routine responsible for reassembling XZ chunked (block) data during decoding. According to the ZDI-26-444 advisory, the flaw exists in the processing of XZ chunked data: when 7-Zip parses a specially crafted XZ stream, an internal length/size computation used to size a heap allocation does not correctly validate attacker-controlled chunk metadata (e.g., an oversized or inconsistent uncompressed/compressed chunk size field) before writing decoded bytes into the destination buffer. The result is a classic heap-based buffer overflow (CWE-787, Out-of-Bounds Write): the decoder writes more data into the heap buffer than was allocated for it, corrupting adjacent heap metadata and/or neighboring heap objects (including, potentially, C++ object vtable pointers used elsewhere in 7-Zip's stream-handling classes, a pattern 7-Zip's archive/stream handlers have exhibited in other 2026 disclosures such as CVE-2026-48095).
Exploitation requires user interaction: a victim must either (a) open an archive file (.7z, .xz, or any container format 7-Zip's signature-based format sniffing routes to the XZ handler) that embeds a maliciously crafted XZ chunk, or (b) visit a webpage that serves/streams a crafted XZ payload to a 7-Zip-integrated component (e.g., shell-extension preview, browser-invoked archive handler, or automated extraction pipeline). No authentication or elevated privileges are required to trigger the bug, and no additional privileges beyond the current user's are needed to reach the vulnerable code path (attack vector local, attack complexity high — CVSS 3.1 vector AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, score 7.0).
Successful exploitation corrupts heap memory in the 7-Zip process (7zFM.exe, 7z.exe, 7zG.exe, or any process that links the 7-Zip/p7zip decompression library, e.g. archive managers, mail/attachment scanners, EDR/AV unpacking pipelines, and CI/build systems that shell out to 7-Zip for artifact extraction) and can be leveraged by a skilled attacker to redirect execution flow and achieve arbitrary code execution with the privileges of the user running the vulnerable process. Because 7-Zip and its bundled 7z.dll/7z.so are embedded inside countless third-party installers, backup tools, malware sandboxes, and automated unpacking/CI pipelines, this is best treated as a software-supply-chain-adjacent exposure: a single crafted XZ archive dropped into a build artifact, email attachment, or software update package can pivot into RCE anywhere 7-Zip silently unpacks untrusted input.
The vulnerability was reported to the vendor (Igor Pavlov / 7-Zip) on 2026-06-05 through Trend Micro ZDI's coordinated disclosure program and publicly disclosed with the vendor fix on 2026-07-15. It is fixed in 7-Zip 26.02 (released 2026-06-25), which shipped ahead of the public advisory. No public proof-of-concept exploit code and no evidence of in-the-wild exploitation were available in open reporting as of the disclosure date, and the CVE is not present in the CISA Known Exploited Vulnerabilities (KEV) catalog. Given 7-Zip's status as one of the most widely deployed open-source archive utilities on Windows (and via p7zip on Linux/macOS), and its use as an embedded/vendored dependency in countless other applications, unpatched installations represent a broad and durable attack surface even absent confirmed active exploitation.
Weaknesses (CWE)
CWE-787, CWE-122, CWE-190, CWE-434, CWE-1284
Target sectors: government administration, finance, health, technology, manufacturing, education, retail, energy, telecoms, software-development
Target regions: Global, North America, Europe, Asia-Pacific
Detections & IOCs
As of 2026-07-23, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 31 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, CVE-2026-14266, T1566, T1566.001, T1566.002, T1189, T1190, T1203, T1204, T1204.002, T1204.001, T1203