New 7-Zip Vulnerability Could Let Crafted XZ Archives Run Code During Extraction
An attacker may be able to execute code on the system by opening a manipulated XZ archive in 7-Zip. On July 15, Trend Micro's Zero Day Initiative (ZDI) described the vulnerability, CVE-2026-14266, which is a heap-based buffer overflow in the archiver's processing of XZ chunked data. On June 25, a 7-Zip 26.02 fix was shipped.
An attacker can "execute code in the context of the current process," according to the alert, thanks to the overflow. The code uses the token that 7-Zip owns and does not acquire any more rights.
Unless the software was started elevated, a typically launched 7-Zip on Windows operates under a filtered standard-user token even on an administrator account, so the attacker acquires those restricted rights. On June 5, Landon Peng of Lunbun LLC reported the bug to 7-Z...