CVE-2026-14266: 7-Zip Heap-Based Buffer Overflow in XZ Chunk Handling Enables Arbitrary Code Execution

CVE-2026-14266 (TL-2026-1428), also tracked as ZDI-26-444, is a high-severity software vulnerability scored CVSS 7, first published 2026-07-16 and last reviewed 2026-07-23. It has no confirmed attribution, affects Igor Pavlov / 7-Zip 7-Zip, references 1 CVE (CVE-2026-14266), maps to 32 MITRE ATT&CK techniques (T1027, T1036, T1036.005), and is covered by 9 detection rules and 34 indicators of compromise.

Key facts for TL-2026-1428

Threat ID
TL-2026-1428
Also known as
ZDI-26-444
Severity
HIGH
CVSS
7 (AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Status
PATCHED
Category
VULNERABILITY
First published
2026-07-16
Last reviewed
2026-07-23
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
government administration, finance, health, technology, manufacturing, education, retail, energy, telecoms, software-development
Target regions
Global, North America, Europe, Asia-Pacific
Detection rules
9
Indicators of compromise
34
Updates
2026-07-23 · 3 updates · revalidated 3× · latest source

Malware and tooling in CVE-2026-14266

Malware and tooling: 7-Zip

A heap-based buffer overflow in 7-Zip's processing of XZ chunked data (CVE-2026-14266, ZDI-26-444) allows arbitrary code execution in the context of the logged-in user when a victim opens a maliciously crafted archive or is served a crafted XZ payload from a malicious webpage. Reported by Landon Peng of Lunbun LLC via Trend Micro's Zero Day Initiative and fixed in 7-Zip 26.02.

How CVE-2026-14266 works

CVE-2026-14266 is a memory-corruption vulnerability in 7-Zip's XZ decompression path, specifically in the routine responsible for reassembling XZ chunked (block) data during decoding. According to the ZDI-26-444 advisory, the flaw exists in the processing of XZ chunked data: when 7-Zip parses a specially crafted XZ stream, an internal length/size computation used to size a heap allocation does not correctly validate attacker-controlled chunk metadata (e.g., an oversized or inconsistent uncompressed/compressed chunk size field) before writing decoded bytes into the destination buffer. The result is a classic heap-based buffer overflow (CWE-787, Out-of-Bounds Write): the decoder writes more data into the heap buffer than was allocated for it, corrupting adjacent heap metadata and/or neighboring heap objects (including, potentially, C++ object vtable pointers used elsewhere in 7-Zip's stream-handling classes, a pattern 7-Zip's archive/stream handlers have exhibited in other 2026 disclosures such as CVE-2026-48095).

Exploitation requires user interaction: a victim must either (a) open an archive file (.7z, .xz, or any container format 7-Zip's signature-based format sniffing routes to the XZ handler) that embeds a maliciously crafted XZ chunk, or (b) visit a webpage that serves/streams a crafted XZ payload to a 7-Zip-integrated component (e.g., shell-extension preview, browser-invoked archive handler, or automated extraction pipeline). No authentication or elevated privileges are required to trigger the bug, and no additional privileges beyond the current user's are needed to reach the vulnerable code path (attack vector local, attack complexity high — CVSS 3.1 vector AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, score 7.0).

Successful exploitation corrupts heap memory in the 7-Zip process (7zFM.exe, 7z.exe, 7zG.exe, or any process that links the 7-Zip/p7zip decompression library, e.g. archive managers, mail/attachment scanners, EDR/AV unpacking pipelines, and CI/build systems that shell out to 7-Zip for artifact extraction) and can be leveraged by a skilled attacker to redirect execution flow and achieve arbitrary code execution with the privileges of the user running the vulnerable process. Because 7-Zip and its bundled 7z.dll/7z.so are embedded inside countless third-party installers, backup tools, malware sandboxes, and automated unpacking/CI pipelines, this is best treated as a software-supply-chain-adjacent exposure: a single crafted XZ archive dropped into a build artifact, email attachment, or software update package can pivot into RCE anywhere 7-Zip silently unpacks untrusted input.

The vulnerability was reported to the vendor (Igor Pavlov / 7-Zip) on 2026-06-05 through Trend Micro ZDI's coordinated disclosure program and publicly disclosed with the vendor fix on 2026-07-15. It is fixed in 7-Zip 26.02 (released 2026-06-25), which shipped ahead of the public advisory. No public proof-of-concept exploit code and no evidence of in-the-wild exploitation were available in open reporting as of the disclosure date, and the CVE is not present in the CISA Known Exploited Vulnerabilities (KEV) catalog. Given 7-Zip's status as one of the most widely deployed open-source archive utilities on Windows (and via p7zip on Linux/macOS), and its use as an embedded/vendored dependency in countless other applications, unpatched installations represent a broad and durable attack surface even absent confirmed active exploitation.

MITRE ATT&CK techniques used in TL-2026-1428

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1036.005 Match Legitimate Resource Name or Location; T1036.007 Masquerading: Double File Extension; T1140 Deobfuscate/Decode Files or Information; T1211 Exploitation for Stealth; T1218 System Binary Proxy Execution

Execution

T1059.001 Command and Scripting Interpreter: PowerShell; T1059.007 Command and Scripting Interpreter: JavaScript; T1203 Exploitation for Client Execution; T1204 User Execution; T1204.001 Malicious Link; T1204.002 Malicious File

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1105 Ingress Tool Transfer

Discovery

T1082 System Information Discovery; T1518 Software Discovery

Initial Access

T1189 Drive-by Compromise; T1190 Exploit Public-Facing Application; T1566 Phishing; T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link

Impact

T1499 Endpoint Denial of Service; T1565 Data Manipulation

Persistence

T1547 Boot or Logon Autostart Execution

Collection

T1560 Archive Collected Data; T1560.001 Archive via Utility

Resource Development

T1583.001 Acquire Infrastructure: Domains; T1587.004 Develop Capabilities: Exploits; T1588.005 Obtain Capabilities: Exploits

Reconnaissance

T1591.004 Gather Victim Org Information: Identify Roles

Affected products and versions in CVE-2026-14266

  • Igor Pavlov / 7-Zip — 7-Zip
    Vulnerable versions: prior to 26.02; 26.00; 26.01
    Fixed in: 26.02
  • Igor Pavlov / 7-Zip — p7zip
    Vulnerable versions: builds using pre-26.02 7-Zip XZ decoder source
    Fixed in: builds incorporating 26.02 XZ decoder fix

Remediation for CVE-2026-14266

Patches

  • 7-Zip 26.02 (released 2026-06-25) — fixes CVE-2026-14266 XZ chunk heap overflow

Immediate actions

  • Upgrade 7-Zip to version 26.02 or later on all Windows, Linux (p7zip), and macOS hosts
  • Inventory third-party software, installers, backup tools, and CI/CD pipelines that vendor or shell out to 7-Zip/7z.dll/7z.so and patch or update those dependencies
  • Restrict or disable automatic archive extraction/preview features (shell extensions, mail-gateway auto-unpack, browser-invoked archive handlers) for untrusted XZ/7z content until patched
  • Apply Attack Surface Reduction / application allow-listing to block 7-Zip components from spawning child processes unexpectedly

Workarounds

  • Avoid opening archives (.7z, .xz, .tar.xz, or any container 7-Zip's format-sniffing may route to the XZ handler) received from untrusted or unsolicited sources
  • Disable 7-Zip shell-integration preview/thumbnail handlers until upgraded
  • Block webmail/browser auto-invocation of 7-Zip for inline archive preview

Longer-term hardening

  • Maintain an SBOM/dependency inventory that tracks vendored compression libraries (7-Zip, p7zip, liblzma) across the environment to accelerate future patch cycles
  • Sandbox or isolate archive-extraction utilities used in automated pipelines (mail scanning, malware sandboxing, CI artifact unpacking) so a decoder RCE cannot escape to the host
  • Deploy EDR memory-corruption exploit mitigations (CFG, heap hardening, ASLR/DEP enforcement) on endpoints that routinely handle untrusted archives
  • Establish a recurring patch-compliance check for 7-Zip and other common archive utilities alongside browser/OS patch cadence

CVEs associated with CVE-2026-14266

CVE-2026-14266

Weaknesses (CWE) in CVE-2026-14266

CWE-787, CWE-122, CWE-190, CWE-434, CWE-1284, CWE-119

Timeline of CVE-2026-14266

  • UAC-0006 begins the 'GetSmoked' spear-phishing campaign exploiting the unrelated, actively-exploited 7-Zip flaw CVE-2025-0411, impersonating PrivatBank payment notices against Ukrainian organizations — cited as precedent for this vulnerability class.
  • CISA adds the unrelated CVE-2025-0411 to the Known Exploited Vulnerabilities catalog following confirmed in-the-wild exploitation, underscoring the real-world abuse risk of 7-Zip archive-parsing bugs generally.
  • An earlier, related 7-Zip heap buffer-write overflow (GHSL-2026-140, GitHub Security Lab) is reported to the vendor as a private SourceForge issue, part of the same run of 7-Zip stream/archive-handler memory-safety findings that includes CVE-2026-14266.
  • 7-Zip 26.01 is released, fixing the GHSL-2026-140 heap buffer-write overflow — a precursor patch cycle in the same codebase area (XZ/stream chunk handling) later revisited by the 26.02 fix for CVE-2026-14266.
  • GitHub Security Lab publicly discloses GHSL-2026-140, documenting the earlier 7-Zip heap buffer-write overflow and its fix in 26.01.
  • Cyber Security News reports on CVE-2026-48095, another 7-Zip heap-overflow flaw in the same family of archive/stream-handling memory-corruption issues predating CVE-2026-14266.
  • Landon Peng of Lunbun LLC reports the 7-Zip XZ chunked-data heap buffer overflow to the vendor via Trend Micro's Zero Day Initiative (case tracked as ZDI-26-444).
  • 7-Zip 26.02 is released by Igor Pavlov, including the fix for the XZ chunk-handling heap overflow along with unrelated feature and performance updates.
  • Cyber Security News publishes coverage of CVE-2026-14266, describing exploitation via crafted archive files or malicious webpages delivering crafted XZ payloads.
  • Zero Day Initiative and the vendor complete coordinated disclosure; CVE-2026-14266 / ZDI-26-444 advisory is published publicly, exactly 40 days after the initial vendor report.
  • Threadlinqs Intelligence Platform ingests and researches CVE-2026-14266 based on the Cyber Security News report and ZDI-26-444 advisory.
  • CISA Known Exploited Vulnerabilities catalog reviewed; CVE-2026-14266 not present, indicating no confirmed active exploitation as of this date.
  • BleepingComputer and other outlets publish further coverage of CVE-2026-14266, urging patching; still no confirmed in-the-wild exploitation or public PoC of this specific CVE.
  • It-Connect publishes patch-installation guidance urging immediate upgrade to 7-Zip 26.02 across Windows, Linux, and macOS endpoints.
  • The Hacker News and GuardianMSSP publish further disclosure-week coverage; still no public PoC or confirmed in-the-wild exploitation as of this date.
  • Community forums (ResetEra) begin discussing the vulnerability and urging users to update to 7-Zip 26.02.
  • SOC Prime publishes detection-focused blog coverage of CVE-2026-14266.

Update history for TL-2026-1428

Sources cited for CVE-2026-14266

Threats related to CVE-2026-14266

Detection coverage for TL-2026-1428

As of 2026-07-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1428 across Splunk SPL, Microsoft KQL and Sigma, covering 34 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats