{"id":"CVE-2026-14266","title":"7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability","summary":"7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this …","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":["CWE-122"],"vendor":"7-zip","product":"7-zip","affected":["7-zip < 26.02"],"patched":["7-zip 26.02"],"published":"2026-07-29","updated":"2026-08-07","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-14266","references":[{"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-444/","label":"zdi-disclosures@trendmicro.com"},{"url":"http://www.openwall.com/lists/oss-security/2026/07/17/12","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","exploit-available"],"epss":0.00742,"epssPercentile":0.52767,"zeroDay":true,"ingestedAt":"2026-08-08T13:22:52.486Z","exploits":{"github":3,"githubRepos":["https://github.com/4minx/CVE-2026-14266","https://github.com/liyuxuan504-byte/CVE-2026-14266","https://github.com/ret2bilibili/CVE-2026-14266"],"checkedAt":"2026-09-21T15:28:01.008Z"},"exploitAvailable":true,"slug":"CVE-2026-14266","body":"## Overview\n\n7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the processing of XZ chunked data. Crafted XZ-compressed data can trigger an overflow of a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30169.\n\n## Affected\n\n- `7-zip < 26.02`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `7-zip 26.02`","depth":"abyssal","depthScore":68,"depthScoreParts":{"impact":42.9,"likelihood":0.1,"exploitation":25,"ransomware":0},"changes":[{"seq":4952,"id":"CVE-2026-14266","ts":1788887218936,"field":"exploit_available","old":"false","new":"true"},{"seq":3835,"id":"CVE-2026-14266","ts":1788886351862,"field":"exploit_available","old":"true","new":"false"},{"seq":2669,"id":"CVE-2026-14266","ts":1788883016523,"field":"exploit_available","old":"false","new":"true"},{"seq":1698,"id":"CVE-2026-14266","ts":1788882420950,"field":"exploit_available","old":"true","new":"false"},{"seq":805,"id":"CVE-2026-14266","ts":1788881854520,"field":"exploit_available","old":"false","new":"true"}]}