7-Zip flaw CVE-2026-14266 lets crafted XZ archives execute code on open

A newly disclosed 7-Zip vulnerability, CVE-2026-14266, allows code execution when users open crafted XZ archives, The Hacker News reports, after Trend Micro’s Zero Day Initiative detailed it on July 15. The heap-based buffer overflow in the XZ chunked data parser could let attackers run code in the context of the current process during extraction, raising drive-by or supply chain risks. 7-Zip is widely used across Windows and other platforms, making rapid patching urgent.

A fix shipped on June 25 in 7-Zip version 26.02; users should upgrade and avoid opening untrusted XZ archives, according to The Hacker News. ZDI’s advisory says the flaw can be triggered by opening a malicious archive and credits 7-Zip for addressing the issue. Watch for vendor advisories, proof-of-concept releases, and any signs of exploitation in the wild. [Developing. This article will be updated.]