# CVE-2026-14266: 7-Zip Heap-Based Buffer Overflow in XZ Chunk Handling Enables Arbitrary Code Execution

> A heap-based buffer overflow in 7-Zip's processing of XZ chunked data (CVE-2026-14266, ZDI-26-444) allows arbitrary code execution in the context of the logged-in user when a victim opens a maliciously crafted archive or is served a crafted XZ payload from a malicious webpage. Reported by Landon Peng of Lunbun LLC via Trend Micro's Zero Day Initiative and fixed in 7-Zip 26.02.

- **Published:** 2026-07-16T00:00:00Z
- **Last reviewed:** 2026-07-23T16:20:29.630Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1428
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-7-zip-xz-chunk-overflow-tl-2026-1428.webp?v=123aca40 (Threadlinqs threat intel: CVE-2026-14266 7-Zip XZ Chunk Overflow: Detection & IOCs (TL-2026-1428) — High severity, 34 IOCs, 9 detection rules.)
- **ID:** TL-2026-1428
- **Severity:** HIGH (CVSS 7)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 34 (2 shown free below)
- **CVEs:** CVE-2026-14266

## Description

CVE-2026-14266 is a memory-corruption vulnerability in 7-Zip's XZ decompression path, specifically in the routine responsible for reassembling XZ chunked (block) data during decoding. According to the ZDI-26-444 advisory, the flaw exists in the processing of XZ chunked data: when 7-Zip parses a specially crafted XZ stream, an internal length/size computation used to size a heap allocation does not correctly validate attacker-controlled chunk metadata (e.g., an oversized or inconsistent uncompressed/compressed chunk size field) before writing decoded bytes into the destination buffer. The result is a classic heap-based buffer overflow (CWE-787, Out-of-Bounds Write): the decoder writes more data into the heap buffer than was allocated for it, corrupting adjacent heap metadata and/or neighboring heap objects (including, potentially, C++ object vtable pointers used elsewhere in 7-Zip's stream-handling classes, a pattern 7-Zip's archive/stream handlers have exhibited in other 2026 disclosures such as CVE-2026-48095).

Exploitation requires user interaction: a victim must either (a) open an archive file (.7z, .xz, or any container format 7-Zip's signature-based format sniffing routes to the XZ handler) that embeds a maliciously crafted XZ chunk, or (b) visit a webpage that serves/streams a crafted XZ payload to a 7-Zip-integrated component (e.g., shell-extension preview, browser-invoked archive handler, or automated extraction pipeline). No authentication or elevated privileges are required to trigger the bug, and no additional privileges beyond the current user's are needed to reach the vulnerable code path (attack vector local, attack complexity high — CVSS 3.1 vector AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, score 7.0).

Successful exploitation corrupts heap memory in the 7-Zip process (7zFM.exe, 7z.exe, 7zG.exe, or any process that links the 7-Zip/p7zip decompression library, e.g. archive managers, mail/attachment scanners, EDR/AV unpacking pipelines, and CI/build systems that shell out to 7-Zip for artifact extraction) and can be leveraged by a skilled attacker to redirect execution flow and achieve arbitrary code execution with the privileges of the user running the vulnerable process. Because 7-Zip and its bundled 7z.dll/7z.so are embedded inside countless third-party installers, backup tools, malware sandboxes, and automated unpacking/CI pipelines, this is best treated as a software-supply-chain-adjacent exposure: a single crafted XZ archive dropped into a build artifact, email attachment, or software update package can pivot into RCE anywhere 7-Zip silently unpacks untrusted input.

The vulnerability was reported to the vendor (Igor Pavlov / 7-Zip) on 2026-06-05 through Trend Micro ZDI's coordinated disclosure program and publicly disclosed with the vendor fix on 2026-07-15. It is fixed in 7-Zip 26.02 (released 2026-06-25), which shipped ahead of the public advisory. No public proof-of-concept exploit code and no evidence of in-the-wild exploitation were available in open reporting as of the disclosure date, and the CVE is not present in the CISA Known Exploited Vulnerabilities (KEV) catalog. Given 7-Zip's status as one of the most widely deployed open-source archive utilities on Windows (and via p7zip on Linux/macOS), and its use as an embedded/vendored dependency in countless other applications, unpatched installations represent a broad and durable attack surface even absent confirmed active exploitation.

## MITRE ATT&CK

- T1566 Phishing
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1189 Drive-by Compromise
- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1204 User Execution
- T1204.002 Malicious File
- T1204.001 Malicious Link
- T1068 Exploitation for Privilege Escalation
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1036.005 Match Legitimate Resource Name or Location
- T1211 Exploitation for Stealth
- T1518 Software Discovery
- T1560 Archive Collected Data
- T1560.001 Archive via Utility
- T1105 Ingress Tool Transfer
- T1565 Data Manipulation
- T1591.004 Gather Victim Org Information: Identify Roles
- T1588.005 Obtain Capabilities: Exploits
- T1583.001 Acquire Infrastructure: Domains
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1036.007 Masquerading: Double File Extension
- T1027 Obfuscated Files or Information
- T1218 System Binary Proxy Execution
- T1547 Boot or Logon Autostart Execution
- T1071.001 Application Layer Protocol: Web Protocols
- T1499 Endpoint Denial of Service
- T1587.004 Develop Capabilities: Exploits
- T1082 System Information Discovery

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Unexpected Child Process Spawned by 7-Zip Family Process Post-Archive-Extraction** (`TL-2026-1428-SPL-002`)

Detects 7zFM.exe, 7z.exe, or 7zG.exe spawning an unexpected child process (shell, script host, or LOLBin) shortly after extracting an archive — the exact post-exploitation signature of a successful CVE-2026-14266 heap-overflow-to-RCE chain in 7-Zip's XZ chunk decoder. A clean 7-Zip extraction never spawns cmd.exe, powershell.exe, wscript.exe, or rundll32.exe as a direct child.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1203, T1204.002, T1036.005
- **Data sources:** Sysmon EventCode 1 (ProcessCreate), DeviceProcessEvents (Defender for Endpoint)
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| where match(ParentImage, "(?i)\\7zFM\.exe$|\\7z\.exe$|\\7zG\.exe$")
| where match(Image, "(?i)\\(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32)\.exe$")
| eval time_since_parent_start=_time-strptime(ParentProcessGuidCreateTime,"%Y-%m-%dT%H:%M:%S")
| table _time, Computer, User, ParentImage, ParentCommandLine, Image, CommandLine, ProcessGuid, ParentProcessGuid
| sort - _time
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("7zFM.exe", "7z.exe", "7zG.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, InitiatingProcessId, ProcessId
| order by Timestamp desc
```

### Sigma

```yaml
title: Suspicious Child Process Spawned from 7-Zip Archive Handler (Windows)
id: 7f3a1c2e-1428-4a1b-9c2d-cve202614266win02
status: experimental
description: Detects an unexpected shell/script/LOLBin child process spawned by 7zFM.exe, 7z.exe, or 7zG.exe, consistent with post-exploitation code execution following a CVE-2026-14266-style XZ chunk heap overflow (ZDI-26-444).
references:
    - https://www.zerodayinitiative.com/advisories/ZDI-26-444/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-16
tags:
    - attack.execution
    - attack.defense-evasion
    - attack.t1203
    - attack.t1204.002
    - attack.t1036.005
    - cve.2026.14266
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\7zFM.exe'
            - '\7z.exe'
            - '\7zG.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
    filter_expected_children:
        Image|endswith:
            - '\conhost.exe'
    condition: selection_parent and selection_child and not filter_expected_children
falsepositives:
    - Legitimate self-extracting archive post-extract scripts invoking cmd.exe or powershell.exe by design
    - Scripted extraction workflows that shell out after a clean extraction
level: high
```

**Known false positives:**

- Legitimate self-extracting archive (SFX) post-extract scripts that intentionally invoke cmd.exe or powershell.exe
- Scripted/automated extraction pipelines that shell out to a helper process after a clean, expected extraction

**Tuning notes:** Baseline and allow-list known internal SFX archives or automated extraction pipelines that legitimately spawn shell children; narrow the child-process list to your environment's actual LOLBin abuse set if volume is high; raise severity further if the child process also performs network egress within seconds.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Mark-of-the-Web XZ/7z/tar.xz File Written to Disk from Untrusted Zone (locked: unlock with TL Creds)
- 7-Zip Process Crash or Restart Immediately Following Untrusted Archive Extraction (locked: unlock with TL Creds)
- CI/CD or Mail-Gateway Automated 7-Zip Extraction Pipeline Producing Anomalous Process Creation (locked: unlock with TL Creds)
- Suspicious Child Process Spawned from 7-Zip Archive Handler (Windows) (locked: unlock with TL Creds)
- [indicator]/7z Extraction Followed by Unexpected Child Process (Linux) (locked: unlock with TL Creds)
- Archive File Extension Anomaly Indicating Crafted XZ Chunk Delivery (locked: unlock with TL Creds)
- Crafted XZ/7z/tar.xz Archive Delivery via Email or Web Download (CVE-2026-14266 Precursor) (locked: unlock with TL Creds)
- Post-Extraction Outbound Connection / Ingress Tool Transfer from 7-Zip Child Process Chain (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 34)

Defanged, TLP:CLEAR.

- File hash: `84ab6c3e1f2dc98cf4d5b8b739237570416bb82e2edaf078e9868663553c5412`
- File hash: `ba74ecae43adc78efaee227a0d7170829b9036e5e7f602cf38f32715efa51826`

Full set of 34 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [7-Zip Vulnerability Let Attackers Execute Arbitrary Code](https://cybersecuritynews.com/7-zip-vulnerability-code-execution/)
- [ZDI-26-444: 7-Zip XZ Chunked Data Heap-Based Buffer Overflow](https://www.zerodayinitiative.com/advisories/ZDI-26-444/)
- [7-Zip HISTORY (26.02 changelog, 2026-06-25)](https://www.7-zip.org/history.txt)
- [Release 7-Zip 26.02](https://github.com/ip7z/7zip/releases/tag/26.02)
- [New 7-Zip Vulnerabilities Let Attackers Execute Arbitrary Code and Compromise Systems](https://cybersecuritynews.com/7-zip-vulnerabilities-code-execution/)
- [GHSL-2026-140: Heap Buffer Write Overflow in 7-Zip](https://securitylab.github.com/advisories/GHSL-2026-140_7-Zip/)
- [CVE-2026-48095: 7-Zip Heap Overflow Flaw](https://socprime.com/blog/cve-2026-48095-7-zip-heap-overflow-flaw/)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1428