7-Zip 26.02 — RCE via Heap-Based Buffer Overflow in XZ Decompression

7-Zip 26.02, released June 25, 2026, fixes CVE-2026-14266, a heap-based buffer overflow in the decompressor's handling of XZ chunked data. The Zero Day Initiative advisory ZDI-26-444, case ZDI-CAN-30169, published July 15, 2026, credits Lunbun LLC's Landon Peng, who reported the flaw to the vendor on June 5, 2026. Crafted XZ data makes the decoder write past the end of its output buffer, and code execution follows in the context of the current process. ZDI scores it CVSS 7.0 with the vector AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, exploitation requires opening a malicious archive or visiting a page that triggers extraction, and no exploitation had been reported at disclosure. One identifier needs untangling: CVE-2025-8088, the reference carried alongside this story in coverage, is the 2025 WinRAR path traversal used by RomCom and listed in CISA's KEV catalog, not this 7-Zip bug.

The score undersells the exposure because the patch model is the story. 7-Zip has no update channel at all, so the fix reaches machines only when a human downloads an installer, and every deployment from the April 27, 2026 release 26.01 backwards stays vulnerable until someone acts. The UI:R in the CVSS vector assumes a person opens the file, and that assumption dissolves wherever 7-Zip code is embedded in automated extraction: mail sandbox detonation, antivirus content inspection, CI jobs that unpack .tar.xz build artifacts. In those pipelines a single inbound XZ stream is the trigger, no click required, and the process context is a service account instead of a user session. Archive-handler bugs in this product family already have a documented kill-chain role, from the 7-Zip Mark-of-the-Web bypass CVE-2025-0411 used as a zero-day by Russian hackers against Ukrainian targets to the RomCom WinRAR phishing campaigns, which is why a decoder memory-corruption bug with code execution merits attention ahead of its 7.0.

The remediation floor is 26.02, and 26.03, released September 3, 2026, is the current version and additionally fixed CVE-2026-58052, where extracting a crafted archive dropped the Mark-of-the-Web designation. Inventory by file version on 7z.exe, 7zG.exe, and 7zFM.exe rather than by installed package, because portable copies and third-party tools that ship their own 7-Zip binaries never appear in software registries. For systems that extract untrusted archives automatically, keep the workers isolated and disposable, since no interactive-user control applies to them. The ZDI advisory carries no indicators of compromise, so hunting is behavioral: Application event log error entries for 7z.exe, 7zG.exe, or 7za.exe following archive handling, 7-Zip processes launched from browser or mail temporary directories, and child process creation from those processes. Gate .xz and .tar.xz attachments from untrusted senders the same way executables are gated.

Two developments would change the assessment. Public technical detail or exploit code for the XZ chunk-parsing path would make this a commodity phishing payload, given the family's precedent as initial access, and the researcher's silence so far means a write-up would land on defenders without warning. Any exploitation telemetry or KEV listing for CVE-2026-14266 would convert the fix from hygiene into incident response for every fleet still running pre-26.02 builds.