CVE-2026-14266Patch(7-zip / 7-zip)

CRITICALCVSS 7.8 · HIGH

Exploitation observed; activity peaked at 30 mentions and remains active

Immediate actions

Patch 7-zip 7-zip systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of XZ chunked data. Crafted XZ-compressed data can trigger an overflow of a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30169.

7-zip CVEs Back to dashboard

8.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-122

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

7-zip

Threat summary

Active exploitation appears in 5 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
86 mentions across 16 observed days

What's happening

Active exploitation reported across 5 signals
Exploit tool or code specified in 1 signal
PoC mentioned or linked in 2 signals
Patch or workaround mentioned in 60 signals
Technical details provided in 73 signals
Disclosure: 32 classified signals
Peaked 11d ago at 30 mentions (2026-07-20); latest day: 1
86 total mentions across 16 days

Affected systems

Vendors

7-zip

Products

7-zip

Deep dive

Activity timeline86 mentions / 16d

Signal classification5 categories

Patch

4552.3%

Disclosure

3237.2%

Active Exploitation

55.8%

General

33.5%

PoC

11.2%

Referenced assets50 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-16	2	Patch2
2026-07-17	11	Disclosure5Patch6
2026-07-18	5	Active Exploitation1Disclosure2Patch2
2026-07-19	5	Patch5
2026-07-20	30	Active Exploitation1Disclosure8General2Patch19
2026-07-21	17	Active Exploitation3Disclosure8General1Patch5
2026-07-22	2	Patch2
2026-07-24	1	Disclosure1
2026-07-25	1	Disclosure1
2026-07-26	4	Disclosure3Patch1
2026-07-29	3	Disclosure2PoC1
2026-08-02	1	Disclosure1
2026-08-04	1	Patch1
2026-08-07	1	Patch1
2026-08-08	1	Patch1
2026-08-16	1	Disclosure1

Full discourse20 posts

Pirat_Nation 🔴@Pirat_Nation87d
Patch
If you use 7-Zip, update it as soon as possible, A newly disclosed security flaw could let attackers run malicious code on your PC if you open a specially crafted XZ archive. The vulnerability, tracked as CVE-2026-14266, has been fixed in 7-Zip version 26.02. 7-Zip does not update automatically, so manually download and install the latest version if you are using an older release.
Post summary
The message announces CVE-2026-14266, a remote code execution flaw in 7‑Zip caused by crafted XZ files, and urges users to install the patch in version 26.02.
1071.0K559.7K3.8K545.0K
349.0K followersView on X
The Hacker News@TheHackersNews88d
Disclosure
🚨 ALERT: A newly disclosed 7-Zip vulnerability could let attackers run code when a user opens a crafted XZ archive. CVE-2026-14266 is a high-severity heap overflow in the XZ decoder. The code runs with the same privileges as 7-Zip. Details: https://thehackernews.com/2026/07/new-7-zip-vulnerability-could-let.html
Post summary
The article announces a newly disclosed high‑severity heap overflow in 7‑Zip’s XZ decoder (CVE‑2026‑14266), noting its potential for code execution, but offers no PoC, exploit tool, or patch details.
1110133097048.3K
2.3M followersView on X
情報の灯台@joho_no_todai89d
Patch
7-Zipに今年2件目のリモートコード実行脆弱性（CVE-2026-14266）が見つかった。CVSS 7.0。 XZ形式の圧縮データを展開する処理にヒープベースのバッファオーバーフローがあり、細工されたファイルを開くと任意コードを実行される可能性がある。修正版26.02は公開済み。 5月末の26.01に続き2ヶ月足らずで再びセキュリティ更新を迫られている。自動更新機能がないこのソフトに、どれだけのPCが古いバージョンのまま残っているのか
Post summary
A heap‐based buffer overflow in 7‑Zip’s XZ extraction code enables remote code execution (CVE‑2026‑14266); version 26.02, containing a fix, has been released.
139078175.6K
11.9K followersView on X
安坂星海 Azaka || VTuber@AzakaSekai_88d
Patch
Remember to update your 7-Zip to 26.02 to fix a possible RCE! #CVE-2026-14266 https://t.co/jCcgkcAsqk
Post summary
The post is a patch advisory urging users to update 7‑Zip to version 26.02 to mitigate a potential remote code execution flaw associated with CVE‑2026‑14266.
117089253.3K
14.6K followersView on X
blackorbird@blackorbird91d
Disclosure
7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability CVE-2026-14266 This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of XZ chunked data. Crafted XZ-compressed data can trigger an overflow of a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
Post summary
The text reports the discovery of CVE‑2026‑14266, detailing a heap-based buffer overflow in 7‑Zip's XZ decompression, with user interaction required for exploitation.
313044145.2K
43.7K followersView on X
elhacker.NET@elhackernet87d
Disclosure
Nueva vulnerabilidad en 7-Zip permitiría la ejecución de código al extraer archivos XZ manipulados Vulnerabilidad de desbordamiento de búfer en 7-Zip (CVE-2026-14266) que podría permitir a un atacante ejecutar código al abrir archivos XZ manipulados https://blog.elhacker.net/2026/07/nueva-vulnerabilidad-en-7-zip.html
Post summary
A newly disclosed vulnerability (CVE-2026-14266) in 7‑Zip involves a buffer overflow that could enable code execution via malicious XZ files.
015042114.6K
141.8K followersView on X
Teegra 🧝‍♀️𝕏@Teeegra88d
Disclosure
یک آسیب‌پذیری امنیتی در نرم‌افزار فشرده‌سازی 7Zip کشف شده که باز کردن یک فایل آرشیو XZ دستکاری‌شده می‌تواند به مهاجم اجازه دهد کد دلخواه خود را روی سیستم قربانی اجرا کند. این نقص با شناسه CVE-2026-14266، یک سرریز بافر مبتنی بر حافظه پشته (heap-based buffer overflow) در نحوه پردازش داده‌های تکه‌تکه‌شده (chunked) فرمت XZ است که توسط ابتکار روز صفر (Zero Day Initiative) شرکت Trend Micro در ۱۵ ژوئیه افشا شد.
Post summary
The post announces a newly disclosed CVE‑2026‑14266 in 7Zip, describing its heap‑based overflow but not providing PoC, exploit, or patch details.
0101981.6K
19.4K followersView on X
IT-Connect.fr@ITConnect_fr88d
Patch
Faille dans 7-Zip : pourquoi vous devriez installer la version 26.02 sans attendre ⚠️ Une faille de sécurité importante estampillée CVE-2026-14266 a été patchée. Plus d'infos par ici : - https://www.it-connect.fr/7-zip-26-02-faille-rce-cve-2026-14266/ #7zip #infosec #cybersecurity https://t.co/zkXhXnvzwb
Post summary
The post announces that CVE-2026-14266 in 7‑ZIP is patched in version 26.02 and urges users to update; no exploitation details are provided.
11201321.2K
11.6K followersView on X
The CyberSec Guru@thecybersecguru91d
Patch
🚨 Millions of 7-Zip users should update immediately. A newly disclosed vulnerability, CVE-2026-14266, could allow Remote Code Execution (RCE) when a victim opens a specially crafted XZ archive. 🔍 Key details: • Heap-based buffer overflow • User interaction required • Exploitable through phishing emails, malicious downloads, and weaponized archive files • Fixed in 7-Zip 26.02 If you use 7-Zip, update now and avoid opening compressed files from untrusted sources. Read the full technical breakdown 👇 https://thecybersecguru.com/news/7-zip-vulnerability-cve-2026-14266/
Post summary
The post announces a newly disclosed 7‑Zip vulnerability (CVE-2026-14266) that allows RCE via a heap-based buffer overflow, emphasizes the need to update to version 26.02, and provides technical details but does not mention exploitation or PoC.
0311731.0K
1.5K followersView on X
Filterbaan | فیلتربان@filterbaan91d
Patch
🚨 اگر از 7-Zip برای باز کردن فایل‌های فشرده استفاده می‌کنید، همین امروز آن را به‌روزرسانی کنید. 📌یک آسیب‌پذیری جدید با شناسه CVE-2026-14266 در 7-Zip کشف شده که می‌تواند به مهاجم اجازه دهد با اجرای یک فایل فشرده دستکاری‌شده یا حتی از طریق یک صفحه وب مخرب، کد دلخواه خود را روی سیستم قربانی اجرا کند. این نقص از نحوه پردازش داده‌های فشرده XZ ناشی می‌شود و باعث سرریز حافظه (Heap Buffer Overflow) می‌شود. اگر کاربر فایل آلوده را باز کند، مهاجم می‌تواند با سطح دسترسی همان کاربر، بدافزار، باج‌افزار یا سایر ابزارهای مخرب را روی سیستم اجرا کند. 📌هرچند این حمله به تعامل کاربر نیاز دارد، اما دقیقاً به همین دلیل مهاجمان معمولاً از ایمیل‌های فیشینگ و فایل‌های فشرده جعلی برای فریب قربانیان استفاده می‌کنند. ✅ برای کاهش خطر: 🔹 7-Zip را به نسخه 26.02 یا جدیدتر ارتقا دهید. 🔹 فایل‌های فشرده را فقط از منابع قابل اعتماد باز کنید. 🔹 اسکن پیوست‌های ایمیل را فعال نگه دارید. https://cybersecuritynews.com/7-zip-vulnerability-code-execution/https://cybersecurityne http://ws.com/7-zip-vulnerability-code-execution/ 🔹 به کاربران و کارکنان درباره خطر فایل‌های فشرده ناشناس آموزش دهید. گاهی فقط باز کردن یک فایل ZIP یا XZ ظاهراً بی‌خطر، می‌تواند نقطه شروع یک حمله سایبری بزرگ باشد. #CyberSecurity #7Zip #CVE202614266 #RCE #Security #Infosec
Post summary
The post announces a newly discovered heap‑overflow CVE in 7‑Zip, explains the risk, and urges users to upgrade and apply mitigations.
0201711.6K
15.0K followersView on X
GovCERT.CZ@GOVCERT_CZ91d
Patch
🚨Upozorňujeme na zranitelnost v 7‑Zip, CVE-2026-14266. Jedná se chybu vznikající při zpracování XZ komprimovaných (chunked) dat během dekomprese, kdy dochází k přetečení vyhrazeného paměťového prostoru na haldě v důsledku nesprávného zpracování vstupních dat. Útočník může tuto zranitelnost zneužít vytvořením speciálně upraveného archivního souboru nebo dodáním škodlivého XZ obsahu, přičemž po jeho otevření uživatelem dojde ke spuštění libovolného kódu v kontextu běžícího procesu se stejnými oprávněními jako má přihlášený uživatel. Zneužití vyžaduje interakci uživatele, typicky otevření škodlivého archivu nebo návštěvu stránky, která takový soubor doručí, přičemž nejsou vyžadována žádná předchozí oprávnění ani autentizace. Zranitelnost postihuje všechny verze 7‑Zip starší než 26.02. 📌Doporučujeme aktualizovat na verzi 26.02 nebo novější.
Post summary
The post warns of CVE‑2026‑14266 in 7‑Zip, explains how a memory overflow can lead to arbitrary code execution, and advises users to upgrade to version 26.02 or later.
06082834
4.3K followersView on X
CERT@certlv91d
Disclosure
‼️Atklāta 7Zip arhivēšanas ievainojamība (CVE-2026-14266), kas ļauj uzbrucējiem attālināti izpildīt patvaļīgu kodu skartajās sistēmās. 7Zip programmatūrai nav pieejami automātiski atjauninājumi. Pārliecinieties, ka tā manuāli atjaunināta uz 26.02. versiju. https://cert.lv/lv/2026/07/nesen-atklata-jauna-7-zip-arhivesanas-ievainojamiba https://t.co/SE3ikipMnu
Post summary
The article announces CVE-2026-14266, a remote code execution vulnerability in 7Zip, and recommends manually updating to version 26.02 to mitigate the risk.
140631.3K
5.7K followersView on X
Daily CyberSecurity@Daily_CyberSec92d
Patch
7-Zip vulnerability CVE-2026-14266 (CVSS 7.0) allows remote code execution via crafted XZ data. Update to 7-Zip 26.02. No exploitation confirmed. #7Zip #CVE202614266 #RCE #BufferOverflow #ZDI #CyberSecurity http://securityonline.info/7-zip-vulnerability-cve-2026-14266/
Post summary
The announcement highlights a remote code execution flaw in 7‑Zip (CVE‑2026‑14266), provides a patch upgrade 26.02, and notes that no exploitation has been observed.
02072552
12.9K followersView on X
Rahmi Demir ⭐⭐⭐⭐⭐@rahmid3mir88d
Disclosure
🚨 7-Zip'te Güvenlik Açığı: Hazırlanmış XZ Arşivleri Kod Çalıştırabiliyor Merhaba #Brolyz 👋 7-Zip'te keşfedilen CVE-2026-14266 kodlu güvenlik açığı, özel hazırlanmış XZ arşivleri aracılığıyla hedef sistemde kod çalıştırılmasına yol açabiliyor. Açık, Trend Micro'nun Zero Day Initiative (ZDI) ekibi tarafından duyuruldu. Güvenlik yaması ise 25 Haziran'da yayımlanan 7-Zip 26.02 sürümüyle kullanıcılara sunulmuştu. ⚠️ Açık Nasıl Çalışıyor? Sorun, 7-Zip'in XZ formatındaki parçalı (chunked) verileri işlerken oluşan heap tabanlı buffer overflow hatasından kaynaklanıyor. Kullanıcının özel hazırlanmış bir XZ arşivini açması durumunda saldırgan, hedef sistemde kendi kodunu çalıştırabiliyor. 📊 Risk Seviyesi ZDI, açığı CVSS 7.0 (Yüksek) olarak derecelendirdi. Ancak istismarın gerçekleşmesi için: 🔹 Kullanıcının zararlı dosyayı açması gerekiyor. 🔹 Güvenilir bir istismar geliştirmek teknik olarak zor. 🔹 20 Temmuz itibarıyla kamuya açık bir PoC veya aktif saldırı raporlanmış değil. 🛡️ Windows Kullanıcıları İçin Varsayılan ayarlarda çalışan 7-Zip, yönetici hesabıyla açılsa bile çoğunlukla standart kullanıcı yetkileriyle çalıştığından, başarılı bir istismar genellikle sınırlı haklarla gerçekleşiyor. ✅ Ne Yapmalısınız? 7-Zip 26.02 veya daha yeni bir sürüme güncelleyin. Bilinmeyen kaynaklardan gelen XZ arşivlerini açmadan önce dikkatli olun. 7-Zip bileşenini kullanan diğer yazılımlar için de üretici güncellemelerini takip edin. 📌 Yama, teknik detaylar kamuoyuyla paylaşılmadan yaklaşık 20 gün önce yayımlandı. Güncellemesini zamanında yapan kullanıcılar, açıklama yapılmadan önce korunmuş oldu.
Post summary
The post announces CVE‑2026‑14266, detailing a heap‑overflow in 7‑Zip’s XZ processing, provides a patch recommendation, and confirms no active exploitation or PoC yet.
0208066
530 followersView on X
Keydric@Keydric86d
Patch
@WifiRumHam @Pirat_Nation You can see on this site that 26.02 version or later fixes it. https://socradar.io/blog/7-zip-cve-2026-14266-rce/
Post summary
The tweet points readers to a blog that notes 7‑Zip version 26.02 or newer includes a fix for CVE‑2026‑14266, without revealing additional exploit details or active attack evidence.
10062929
380 followersView on X
Scooter Software@ScooterSoftware86d
Patch
We've released Beyond Compare 5.2.4.32425. Updated 7-zip to v26.02. Fixes CVE-2026-14266. Updated UnRAR source to v7.2.7 and UnRAR.dll to v7.2.3.
Post summary
The message announces software updates that include a patch for CVE‑2026‑14266, with no additional exploit or vulnerability details provided.
01060283
2.2K followersView on X
小鹏Digital@RocM30187d
Patch
7-Zip 被曝出一个高危堆缓冲区溢出漏洞，编号 CVE-2026-14266，攻击者可借精心构造的 XZ 压缩包远程执行任意代码。漏洞已在 7-Zip 26.02 修复，老版本用户最好马上更新，别再拖。 https://t.co/t9ObAYIMpu
Post summary
The text reports a heap buffer overflow in 7‑Zip (CVE‑2026‑14266) that allows remote code execution via crafted XZ files, notes the fix was released in version 26.02, and urges users to update.
000321.6K
16.1K followersView on X
Open Source Security mailing list@oss_security89d
Patch
CVE-2026-14266: 7-Zip: XZ Decompression Heap-based Buffer Overflow, Code Execution https://www.openwall.com/lists/oss-security/2026/07/17/12 Fixed in 26.02
Post summary
CVE-2026-14266 is a heap‑based buffer overflow in 7‑Zip's XZ decompression that can lead to code execution; the issue is fixed in version 26.02.
01040711
4.7K followersView on X
connect24h@connect24h86d
Patch
また手動更新か。現場には地味に痛い。先日、紹介された脆弱性の情報が各所で報告中。詳細は次スレに。 7-ZipのXZ chunked data処理にheap-based buffer overflow、CVE-2026-14266。CVSS 7.0で、細工したファイルを開くと現在のプロセス権限で任意コードを実行される可能性がある。標的型メールの添付経路と噛み合うのが嫌らしい。資産管理ではインストール版だけでなくportable版、7z.exeを同梱する製品まで棚卸しし、26.02へ更新してほしい。自動更新を待てない案件だ。初動確認用に保存推奨。 #セキュリティ
Post summary
The post warns about CVE‑2026‑14266, a heap‑based buffer overflow in 7‑Zip that could allow arbitrary code execution via malicious files, and urges users to manually update to version 26.02 to mitigate the risk.
20011610
4.8K followersView on X
Misbar | مسبار@MisbarSec87d
Disclosure
📌 ثغرة جديدة في 7-Zip قد تسمح بنفي الشفرة أثناء استخراج أرشيف XZ المُصمم 🛡️ الفئة: ثغرة 📝 الملخص: تسببت ثغرة جديدة في 7-Zip، المسماة CVE-2026-14266، في تعرض نظام الاستخراج لخطر تجاوز الحد الأعلى للذاكرة، مما يسمح للمهاجمين بنفي الشفرة في سياق العملية الحالية. وقد تم اكتشاف هذه الثغرة من قبل مبادرة Trend Micro للتصديف الصفراوي (ZDI) في 15 يوليو. تم إصدار تصحيح لهذه الثغرة في إصدار 7-Zip 26.02 في 25 يونيو. يُنصح بـ تحديث برنامج 7-Zip إلى الإصدار الأخير لتجنب المخاطر المحتملة. 🗓️ تاريخ النشر: 20/07/2026 🔗 للمزيد: https://thehackernews.com/2026/07/new-7-zip-vulnerability-could-let.html
Post summary
A newly discovered CVE-2026-14266 in 7‑Zip causes a memory overflow that can lead to code execution; a patch is available in version 7‑Zip 26.02 and users are advised to update.
00040705
406 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	7-zip	7-zip	-	-	-

Explore more

Back to dashboard 7-zip CVEs 7-zip vulnerabilities

What researchers are saying

CVE-2026-14266

Pirat_Nation 🔴[verified]@Pirat_NationPatch

The message announces CVE-2026-14266, a remote code execution flaw in 7‑Zip caused by crafted XZ files, and urges users to install the patch in version 26.02.

情報の灯台[verified]@joho_no_todaiPatch

A heap‐based buffer overflow in 7‑Zip’s XZ extraction code enables remote code execution (CVE‑2026‑14266); version 26.02, containing a fix, has been released.

安坂星海 Azaka || VTuber[verified]@AzakaSekai_Patch

The post is a patch advisory urging users to update 7‑Zip to version 26.02 to mitigate a potential remote code execution flaw associated with CVE‑2026‑14266.

blackorbird[verified]@blackorbirdDisclosure

The text reports the discovery of CVE‑2026‑14266, detailing a heap-based buffer overflow in 7‑Zip's XZ decompression, with user interaction required for exploitation.

Teegra 🧝‍♀️𝕏[verified]@TeeegraDisclosure

The post announces a newly disclosed CVE‑2026‑14266 in 7Zip, describing its heap‑based overflow but not providing PoC, exploit, or patch details.

The CyberSec Guru[verified]@thecybersecguruPatch

The post announces a newly disclosed 7‑Zip vulnerability (CVE-2026-14266) that allows RCE via a heap-based buffer overflow, emphasizes the need to update to version 26.02, and provides technical details but does not mention exploitation or PoC.

Filterbaan | فیلتربان[verified]@filterbaanPatch

The post announces a newly discovered heap‑overflow CVE in 7‑Zip, explains the risk, and urges users to upgrade and apply mitigations.

GovCERT.CZ[verified]@GOVCERT_CZPatch

The post warns of CVE‑2026‑14266 in 7‑Zip, explains how a memory overflow can lead to arbitrary code execution, and advises users to upgrade to version 26.02 or later.