CVE-2026-14266: 7-Zip Heap-Based Buffer Overflow in XZ Chunk Handling Enables Arbitrary Code Execution

Key facts for 7-Zip XZ chunk overflow

Detection coverage for 7-Zip XZ chunk overflow

As of 2026-07-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1428 across Splunk SPL, Microsoft KQL and Sigma, covering 34 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Unexpected Child Process Spawned by 7-Zip Family Process Post-Archive-Extraction

Detects 7zFM.exe, 7z.exe, or 7zG.exe spawning an unexpected child process (shell, script host, or LOLBin) shortly after extracting an archive — the exact post-exploitation signature of a successful CVE-2026-14266 heap-overflow-to-RCE chain in 7-Zip's XZ chunk decoder. A clean 7-Zip extraction never spawns cmd.exe, powershell.exe, wscript.exe, or rundll32.exe as a direct child.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1203, T1204.002, T1036.005
• Data sources: Sysmon EventCode 1 (ProcessCreate), DeviceProcessEvents (Defender for Endpoint)
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| where match(ParentImage, "(?i)\\7zFM\.exe$|\\7z\.exe$|\\7zG\.exe$")
| where match(Image, "(?i)\\(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32)\.exe$")
| eval time_since_parent_start=_time-strptime(ParentProcessGuidCreateTime,"%Y-%m-%dT%H:%M:%S")
| table _time, Computer, User, ParentImage, ParentCommandLine, Image, CommandLine, ProcessGuid, ParentProcessGuid
| sort - _time

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("7zFM.exe", "7z.exe", "7zG.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, InitiatingProcessId, ProcessId
| order by Timestamp desc

Sigma

title: Suspicious Child Process Spawned from 7-Zip Archive Handler (Windows)
id: 7f3a1c2e-1428-4a1b-9c2d-cve202614266win02
status: experimental
description: Detects an unexpected shell/script/LOLBin child process spawned by 7zFM.exe, 7z.exe, or 7zG.exe, consistent with post-exploitation code execution following a CVE-2026-14266-style XZ chunk heap overflow (ZDI-26-444).
references:
    - https://www.zerodayinitiative.com/advisories/ZDI-26-444/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-16
tags:
    - attack.execution
    - attack.defense-evasion
    - attack.t1203
    - attack.t1204.002
    - attack.t1036.005
    - cve.2026.14266
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\7zFM.exe'
            - '\7z.exe'
            - '\7zG.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
    filter_expected_children:
        Image|endswith:
            - '\conhost.exe'
    condition: selection_parent and selection_child and not filter_expected_children
falsepositives:
    - Legitimate self-extracting archive post-extract scripts invoking cmd.exe or powershell.exe by design
    - Scripted extraction workflows that shell out after a clean extraction
level: high

Known false positives:

• Legitimate self-extracting archive (SFX) post-extract scripts that intentionally invoke cmd.exe or powershell.exe
• Scripted/automated extraction pipelines that shell out to a helper process after a clean, expected extraction

Tuning notes: Baseline and allow-list known internal SFX archives or automated extraction pipelines that legitimately spawn shell children; narrow the child-process list to your environment's actual LOLBin abuse set if volume is high; raise severity further if the child process also performs network egress within seconds.

• 🔒 Mark-of-the-Web XZ/7z/tar.xz File Written to Disk from Untrusted Zone · unlock with TL Creds
• 🔒 7-Zip Process Crash or Restart Immediately Following Untrusted Archive Extraction · unlock with TL Creds
• 🔒 CI/CD or Mail-Gateway Automated 7-Zip Extraction Pipeline Producing Anomalous Process Creation · unlock with TL Creds
• 🔒 Suspicious Child Process Spawned from 7-Zip Archive Handler (Windows) · unlock with TL Creds
• 🔒 [indicator]/7z Extraction Followed by Unexpected Child Process (Linux) · unlock with TL Creds
• 🔒 Archive File Extension Anomaly Indicating Crafted XZ Chunk Delivery · unlock with TL Creds
• 🔒 Crafted XZ/7z/tar.xz Archive Delivery via Email or Web Download (CVE-2026-14266 Precursor) · unlock with TL Creds
• 🔒 Post-Extraction Outbound Connection / Ingress Tool Transfer from 7-Zip Child Process Chain · unlock with TL Creds

Indicators of compromise for 7-Zip XZ chunk overflow

As of 2026-07-23, Threadlinqs Intelligence tracks 34 indicators of compromise for TL-2026-1428.

Sample indicators (2 of 34)

• File hash: 84ab6c3e1f2dc98cf4d5b8b739237570416bb82e2edaf078e9868663553c5412
• File hash: ba74ecae43adc78efaee227a0d7170829b9036e5e7f602cf38f32715efa51826

Defanged, TLP:CLEAR. Full set of 34 indicators: unlock with TL Creds.

How 7-Zip XZ chunk overflow works

Reported by Landon Peng of Lunbun LLC via Trend Micro's Zero Day Initiative and fixed in 7-Zip 26.02.

CVE-2026-14266 is a memory-corruption vulnerability in 7-Zip's XZ decompression path, specifically in the routine responsible for reassembling XZ chunked (block) data during decoding. According to the ZDI-26-444 advisory, the flaw exists in the processing of XZ chunked data: when 7-Zip parses a specially crafted XZ stream, an internal length/size computation used to size a heap allocation does not correctly validate attacker-controlled chunk metadata (e.g., an oversized or inconsistent uncompressed/compressed chunk size field) before writing decoded bytes into the destination buffer. The result is a classic heap-based buffer overflow (CWE-787, Out-of-Bounds Write): the decoder writes more data into the heap buffer than was allocated for it, corrupting adjacent heap metadata and/or neighboring heap objects (including, potentially, C++ object vtable pointers used elsewhere in 7-Zip's stream-handling classes, a pattern 7-Zip's archive/stream handlers have exhibited in other 2026 disclosures such as CVE-2026-48095).

Exploitation requires user interaction: a victim must either (a) open an archive file (.7z, .xz, or any container format 7-Zip's signature-based format sniffing routes to the XZ handler) that embeds a maliciously crafted XZ chunk, or (b) visit a webpage that serves/streams a crafted XZ payload to a 7-Zip-integrated component (e.g., shell-extension preview, browser-invoked archive handler, or automated extraction pipeline). No authentication or elevated privileges are required to trigger the bug, and no additional privileges beyond the current user's are needed to reach the vulnerable code path (attack vector local, attack complexity high — CVSS 3.1 vector AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, score 7.0).

Successful exploitation corrupts heap memory in the 7-Zip process (7zFM.exe, 7z.exe, 7zG.exe, or any process that links the 7-Zip/p7zip decompression library, e.g. archive managers, mail/attachment scanners, EDR/AV unpacking pipelines, and CI/build systems that shell out to 7-Zip for artifact extraction) and can be leveraged by a skilled attacker to redirect execution flow and achieve arbitrary code execution with the privileges of the user running the vulnerable process. Because 7-Zip and its bundled 7z.dll/7z.so are embedded inside countless third-party installers, backup tools, malware sandboxes, and automated unpacking/CI pipelines, this is best treated as a software-supply-chain-adjacent exposure: a single crafted XZ archive dropped into a build artifact, email attachment, or software update package can pivot into RCE anywhere 7-Zip silently unpacks untrusted input.

The vulnerability was reported to the vendor (Igor Pavlov / 7-Zip) on 2026-06-05 through Trend Micro ZDI's coordinated disclosure program and publicly disclosed with the vendor fix on 2026-07-15. It is fixed in 7-Zip 26.02 (released 2026-06-25), which shipped ahead of the public advisory. No public proof-of-concept exploit code and no evidence of in-the-wild exploitation were available in open reporting as of the disclosure date, and the CVE is not present in the CISA Known Exploited Vulnerabilities (KEV) catalog. Given 7-Zip's status as one of the most widely deployed open-source archive utilities on Windows (and via p7zip on Linux/macOS), and its use as an embedded/vendored dependency in countless other applications, unpatched installations represent a broad and durable attack surface even absent confirmed active exploitation.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1036.005 Match Legitimate Resource Name or Location; T1036.007 Masquerading: Double File Extension; T1140 Deobfuscate/Decode Files or Information; T1211 Exploitation for Stealth; T1218 System Binary Proxy Execution

Execution

T1059.001 Command and Scripting Interpreter: PowerShell; T1059.007 Command and Scripting Interpreter: JavaScript; T1203 Exploitation for Client Execution; T1204 User Execution; T1204.001 Malicious Link; T1204.002 Malicious File

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1105 Ingress Tool Transfer

Discovery

T1082 System Information Discovery; T1518 Software Discovery

Initial Access

T1189 Drive-by Compromise; T1190 Exploit Public-Facing Application; T1566 Phishing; T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link

Impact

T1499 Endpoint Denial of Service; T1565 Data Manipulation

Persistence

T1547 Boot or Logon Autostart Execution

Collection

T1560 Archive Collected Data; T1560.001 Archive via Utility

Resource Development

T1583.001 Acquire Infrastructure: Domains; T1587.004 Develop Capabilities: Exploits; T1588.005 Obtain Capabilities: Exploits

Reconnaissance

T1591.004 Gather Victim Org Information: Identify Roles

Remediation for 7-Zip XZ chunk overflow

Patches

• 7-Zip 26.02 (released 2026-06-25) — fixes CVE-2026-14266 XZ chunk heap overflow

Immediate actions

• Upgrade 7-Zip to version 26.02 or later on all Windows, Linux (p7zip), and macOS hosts
• Inventory third-party software, installers, backup tools, and CI/CD pipelines that vendor or shell out to 7-Zip/7z.dll/7z.so and patch or update those dependencies
• Restrict or disable automatic archive extraction/preview features (shell extensions, mail-gateway auto-unpack, browser-invoked archive handlers) for untrusted XZ/7z content until patched
• Apply Attack Surface Reduction / application allow-listing to block 7-Zip components from spawning child processes unexpectedly

Workarounds

• Avoid opening archives (.7z, .xz, .tar.xz, or any container 7-Zip's format-sniffing may route to the XZ handler) received from untrusted or unsolicited sources
• Disable 7-Zip shell-integration preview/thumbnail handlers until upgraded
• Block webmail/browser auto-invocation of 7-Zip for inline archive preview

Longer-term hardening

• Maintain an SBOM/dependency inventory that tracks vendored compression libraries (7-Zip, p7zip, liblzma) across the environment to accelerate future patch cycles
• Sandbox or isolate archive-extraction utilities used in automated pipelines (mail scanning, malware sandboxing, CI artifact unpacking) so a decoder RCE cannot escape to the host
• Deploy EDR memory-corruption exploit mitigations (CFG, heap hardening, ASLR/DEP enforcement) on endpoints that routinely handle untrusted archives
• Establish a recurring patch-compliance check for 7-Zip and other common archive utilities alongside browser/OS patch cadence

Affected and fixed versions

• Igor Pavlov / 7-Zip — 7-Zip
  Vulnerable versions: prior to 26.02; 26.00; 26.01
  Fixed in: 26.02
• Igor Pavlov / 7-Zip — p7zip
  Vulnerable versions: builds using pre-26.02 7-Zip XZ decoder source
  Fixed in: builds incorporating 26.02 XZ decoder fix

Timeline of 7-Zip XZ chunk overflow

Last updated 2026-07-23 · 3 updates · revalidated 3× · latest source

• 2024-10-01 UAC-0006 begins the 'GetSmoked' spear-phishing campaign exploiting the unrelated, actively-exploited locked-ioc-29 flaw CVE-2025-0411, impersonating locked-ioc-21 payment notices against Ukrainian organizations — cited as precedent for this vulnerability class.
• 2025-02-06 CISA adds the unrelated CVE-2025-0411 to the Known Exploited Vulnerabilities catalog following confirmed in-the-wild exploitation, underscoring the real-world abuse risk of locked-ioc-29 archive-parsing bugs generally.
• 2026-04-24 An earlier, related locked-ioc-29 heap buffer-write overflow (GHSL-2026-140, GitHub Security Lab) is reported to the vendor as a private SourceForge issue, part of the same run of locked-ioc-29 stream/archive-handler memory-safety findings that includes CVE-2026-14266.
• 2026-04-27 locked-ioc-29 26.01 is released, fixing the GHSL-2026-140 heap buffer-write overflow — a precursor patch cycle in the same codebase area (XZ/stream chunk handling) later revisited by the 26.02 fix for CVE-2026-14266.
• 2026-05-22 GitHub Security Lab publicly discloses GHSL-2026-140, documenting the earlier locked-ioc-29 heap buffer-write overflow and its fix in 26.01.
• 2026-05-29 Cyber Security News reports on CVE-2026-48095, another locked-ioc-29 heap-overflow flaw in the same family of archive/stream-handling memory-corruption issues predating CVE-2026-14266.
• 2026-06-05 locked-ioc-17 of locked-ioc-20 reports the locked-ioc-29 XZ chunked-data heap buffer overflow to the vendor via Trend Micro's locked-ioc-12 (case tracked as ZDI-26-444).
• 2026-06-25 locked-ioc-18 is released by Igor Pavlov, including the fix for the XZ chunk-handling heap overflow along with unrelated feature and performance updates.
• 2026-07-15 Cyber Security News publishes coverage of CVE-2026-14266, describing exploitation via crafted archive files or malicious webpages delivering crafted XZ payloads.
• 2026-07-15 locked-ioc-12 and the vendor complete coordinated disclosure; CVE-2026-14266 / ZDI-26-444 advisory is published publicly, exactly 40 days after the initial vendor report.
• 2026-07-16 Threadlinqs Intelligence Platform ingests and researches CVE-2026-14266 based on the Cyber Security News report and ZDI-26-444 advisory.
• 2026-07-16 CISA Known Exploited Vulnerabilities catalog reviewed; CVE-2026-14266 not present, indicating no confirmed active exploitation as of this date.
• 2026-07-18 BleepingComputer and other outlets publish further coverage of CVE-2026-14266, urging patching; still no confirmed in-the-wild exploitation or public PoC of this specific CVE.
• 2026-07-19 It-Connect publishes patch-installation guidance urging immediate upgrade to locked-ioc-18 across Windows, Linux, and macOS endpoints.
• 2026-07-20 The Hacker News and GuardianMSSP publish further disclosure-week coverage; still no public PoC or confirmed in-the-wild exploitation as of this date.
• 2026-07-21 Community forums (ResetEra) begin discussing the vulnerability and urging users to update to locked-ioc-18.
• 2026-07-23 SOC Prime publishes detection-focused blog coverage of CVE-2026-14266.

Update history

• 2026-07-23 — CVE-2026-14266: locked-ioc-29 Heap-Based Buffer Overflow in XZ Chunked Data Handling (locked-ioc-16): What changed No severity/exploitability/status escalation — the new report's exploitability remains POC_PUBLIC (a crash-only PoC generator, not a working RCE), consistent with the existing record; status remains PATCHED (locked-ioc-18). New
• 2026-07-21 — locked-ioc-29 XZ Decoder Heap-Based Buffer Overflow Enables Code Execution via Crafted Archives (CVE-2026-14266): What changed No field escalation: severity remains HIGH, status remains PATCHED, CVSS remains 7.0. The newer report itself characterizes exploitability as THEORETICAL (vs. the existing record's POC_PUBLIC) — a downgrade, correctly NOT appli
• 2026-07-18 — locked-ioc-29 Fixes CVE-2026-14266 Heap-Based Buffer Overflow RCE in XZ Decompression: What changed No change to severity (HIGH), exploitability (POC_PUBLIC), status (PATCHED), or CVSS (7.0) — the newer report confirms rather than escalates these facts. New indicators (6) Indicator values are withheld at this access level. Ne

Sources cited for 7-Zip XZ chunk overflow

• ZDI-26-444: 7-Zip XZ Chunked Data Heap-Based Buffer Overflow zerodayinitiative.com · Advisory · 2026-07-15
• CISA Known Exploited Vulnerabilities Catalog CISA · Government advisory · 2026-07-16
• 7-Zip HISTORY (26.02 changelog, 2026-06-25) 7-zip.org · Vendor report · 2026-06-25
• Release 7-Zip 26.02 GitHub · Vendor report · 2026-06-25
• GHSL-2026-140: Heap Buffer Write Overflow in 7-Zip GitHub · Research · 2026-05-01
• CVE-2026-48095: 7-Zip Heap Overflow Flaw socprime.com · Blog · 2026-05-29
• 7-Zip Vulnerability Let Attackers Execute Arbitrary Code cybersecuritynews.com · News · 2026-07-15
• New 7-Zip Vulnerabilities Let Attackers Execute Arbitrary Code and Compromise Systems cybersecuritynews.com · News · 2026-05-29

Threats related to 7-Zip XZ chunk overflow

• 7-Zip NTFS Handler Heap Overflow CVE-2026-48095 — vtable Hijack via Crafted Archive (GHSL-2026-140)
• Multiple Vulnerabilities in Firefox 152 Enable Remote Code Execution and Sandbox Escape (MFSA 2026-57)
• CVE-2026-11645: Actively Exploited V8 Out-of-Bounds Memory Access Zero-Day in Google Chrome

Related coverage of this activity

• ServiceNow multiple maximum-severity flaws

Previous and next in vulnerability

• AnyDesk "Send Support Information" Link-Following Denial-of-Service (CVE-2026-15682) Previous report