ShellCodeX Intelligence Brief
CRITICAL
Vulnerabilities
7-Zip Heap Overflow in XZ Extraction (CVE-2026-14266) Enables Code Execution
Source headline: New 7-Zip Vulnerability Could Let Crafted XZ Archives Run Code During Extraction
Threat level
Critical
Signal strength
75/100
Source confidence
1 source
Published
16 hours ago
Intelligence Summary
Opening a crafted XZ archive in 7-Zip can trigger a heap-based buffer overflow during extraction. The vulnerability, CVE-2026-14266, may allow an attacker to execute code in the context of the 7-Zip process. Trend Micro’s Zero Day Initiative described the issue and its impact in detail. A fix was shipped in 7-Zip 26.02. Users and administrators should update promptly and avoid extracting untrusted XZ archives.
Recommended Action
Prioritize immediate review, validate exposure, and patch or mitigate affected systems.
Topics
Original reporting
The Hacker News
New 7-Zip Vulnerability Could Let Crafted XZ Archives Run Code During Extraction
Open original source
