7-Zip flaw lets booby-trapped XZ archives run code — update to 26.02

Opening the wrong archive can be enough: a heap buffer overflow in 7-Zip’s XZ decoder, tracked as CVE-2026-14266 with a CVSS score of 7.0, allows crafted archives to execute code with the user’s privileges. Every release from 21.07 (2021) through 26.01 carries the bug; 7-Zip 26.02, available since late June, fixes it. Trend Micro’s Zero Day Initiative published its advisory in mid-July after researcher Landon Peng reported the issue in early June.

The root cause sits in how the decoder handles multi-stage XZ streams: each pass was handed the full output buffer size rather than the space actually remaining, so a malicious archive can push writes past the buffer’s end. No in-the-wild exploitation has surfaced so far, though public advisories tend to shorten that grace period considerably.

One practical note: 7-Zip has no auto-update mechanism. The fix arrives only if you fetch it yourself — worth remembering for servers and NAS boxes where 7-Zip quietly does the unpacking inside scripts.