Mallory.Ai 7-Zip Vulnerability CVE-2026-14266 Allows Remote Code Execution
Article Content
- •CVE-2026-14266 allows remote code execution through crafted XZ files.
- •Users must open malicious files or visit compromised sites to be exploited.
- •7-Zip version 26.02 released to patch the vulnerability; users urged to update.
A newly disclosed vulnerability in 7-Zip, tracked as CVE-2026-14266, enables remote code execution via a heap-based buffer overflow when processing crafted XZ chunked data. Attackers can exploit this flaw by tricking users into opening malicious files or visiting compromised websites. The vulnerability has been assigned a CVSS score of 7.0, indicating a high risk due to the required user interaction. The flaw was reported by Landon Peng of Lunbun LLC and disclosed by Trend Micro's Zero-Day Initiative (ZDI) under advisory ZDI-26-444. Users are advised to update to 7-Zip version 26.02, released on June 25, 2026, which contains the necessary patch. As of the publication date, no public proof-of-concept or in-the-wild exploitation has been confirmed. However, the widespread use of 7-Zip heightens the potential impact of this vulnerability.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (17)
Following this threat?
Track Trend Micro and CVE-2026-14266 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…