ZDI 26 444

www.zerodayinitiative.com • July 21, 2026

This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the processing of XZ chunked data. Crafted XZ-compressed data can trigger an overflow of a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.

Lunbun LLC (Landon Peng)

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

7-Zip Vulnerability CVE-2026-14266 Allows Remote Code Execution A newly disclosed vulnerability in 7-Zip, tracked as CVE-2026-14266, enables remote code execution via a heap-based buffer overflow when processing crafted XZ chunked data. Attackers can exploit this flaw by tricking users into opening malicious files or visiting compromised websites. The vulnerability has been assigned a CVSS score of 7.0, indicating a high risk due to the required user interaction. The flaw was reported by Landon Peng of Lunbun LLC and disclosed by Trend Micro's Zero-Day Initiative (ZDI) under advisory ZDI-26-444. Users are advised to update to 7-Zip version 26.02, released on June 25, 2026, which contains the necessary patch. As of the publication date, no public proof-of-concept or in-the-wild exploitation has been confirmed. However, the widespread use of 7-Zip heightens the potential impact of this vulnerability. 14 sources 65

Extracted Entities

ZDI 26 444

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Tools (1)