7

Cybersecuritynews •Guru Baran • July 17, 2026

A newly disclosed vulnerability in 7-Zip, one of the most widely used open-source file archiving tools, could allow remote attackers to execute arbitrary code on affected systems. Tracked as CVE-2026-14266, the flaw stems from improper handling of XZ chunked data and has been addressed in the latest software update. The vulnerability resides in how 7-Zip […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

7-Zip Vulnerability CVE-2026-14266 Allows Remote Code Execution A newly disclosed vulnerability in 7-Zip, tracked as CVE-2026-14266, enables remote code execution via a heap-based buffer overflow when processing crafted XZ chunked data. Attackers can exploit this flaw by tricking users into opening malicious files or visiting compromised websites. The vulnerability has been assigned a CVSS score of 7.0, indicating a high risk due to the required user interaction. The flaw was reported by Landon Peng of Lunbun LLC and disclosed by Trend Micro's Zero-Day Initiative (ZDI) under advisory ZDI-26-444. Users are advised to update to 7-Zip version 26.02, released on June 25, 2026, which contains the necessary patch. As of the publication date, no public proof-of-concept or in-the-wild exploitation has been confirmed. However, the widespread use of 7-Zip heightens the potential impact of this vulnerability. 17 sources 65

Extracted Entities

7

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Tools (1)