The vulnerability CVE-2026-14266 in 7-Zip arises from a heap-based buffer overflow during the processing of XZ archives. This flaw allows an attacker to execute code within the 7-Zip process when a user opens a specially prepared XZ archive. However, this execution is limited by 7-Zip's current permissions; for example, 7-Zip running under standard user privileges on Windows cannot escalate to administrator rights.
The vulnerability was reported on June 5 by Landon Peng of Lunbun LLC and was fixed in 7-Zip version 26.02 on June 25. ZDI rated the vulnerability as 7.0 (High), a more conservative assessment than some news sites that classified it as 'Critical'. Exploitation requires user interaction, and remote access over a network is not possible. As of July 20, 2026, no public proof-of-concept or real-world exploitation of this vulnerability has been reported.
The patched code is located in the MixCoder_Code function within the C/XzDec.c file. In previous versions, the total amount of data to be written to the buffer was not calculated correctly. Version 26.02 corrects this error by preventing writes that exceed the buffer boundary. Although the same flaw has existed since at least version 21.07, it is not definitively known which versions are exploitable. 7-Zip users must manually install version 26.02 or a newer version.