CVE-2026-14266
7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability
7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the processing of XZ chunked data. Crafted XZ-compressed data can trigger an overflow of a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30169.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability
7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the processing of XZ chunked data. Crafted XZ-compressed data can trigger an overflow of a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30169.
- Record
CVE-2026-14266- CVSS 3.0
- 7.0 High
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-122
- Updated
- 2026-11-02
EUVDEUVD-2026-50420
7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the processing of XZ chunked data. Crafted XZ-compressed data can trigger an overflow of a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30169.
- Record
EUVD-2026-50420- CVSS 3.0
- 7.0 High
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-836v-xv29-x32v
7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This...
7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the processing of XZ chunked data. Crafted XZ-compressed data can trigger an overflow of a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30169.
- Record
GHSA-836v-xv29-x32v- CVSS 3.0
- 7.0 High
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-122
- Updated
- 2026-11-02
NVD
7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the processing of XZ chunked data. Crafted XZ-compressed data can trigger an overflow of a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30169.
- Record
CVE-2026-14266- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 3.0
- 7.0 High
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-122
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-14266
7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of XZ chunked data. Crafted XZ-compressed data can trigger an overflow of a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30169.
- Record
DEBIAN-CVE-2026-14266- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-14266
7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of XZ chunked data. Crafted XZ-compressed data can trigger an overflow of a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30169.
- Record
UBUNTU-CVE-2026-14266- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 3.0
- 7.0 High
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVopenSUSE-SU-2026:11319-1 No score
7zip-26.02-1.1 on GA media
These are all security issues fixed in the 7zip-26.02-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11319-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21641-1 No score
Security update for 7zip
This update for 7zip fixes the following issue:
Update to 26.02.
- CVE-2026-14266: heap buffer overflow when processing XZ chunked data can lead to remote code execution (bsc#1273065).
- Record
openSUSE-SU-2026:21641-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:23317-1 No score
Security update for 7zip
This update for 7zip fixes the following issue:
Update to 26.02.
- CVE-2026-14266: heap buffer overflow when processing XZ chunked data can lead to remote code execution (bsc#1273065).
- Record
SUSE-SU-2026:23317-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:3869-1 No score
Security update for 7zip
This update for 7zip fixes the following issue:
- CVE-2026-14266: heap buffer overflow when processing XZ chunked data can lead to remote code execution (bsc#1273065).
Changes for 7zip:
- Updated to 26.02.
- Record
SUSE-SU-2026:3869-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
7zipDebian:12 |
before 22.01+really26.02+dfsg-0+deb12u1, plus listed versions 22.01+dfsg-10~exp122.01+dfsg-822.01+dfsg-8+deb12u122.01+dfsg-922.01+really25.01+dfsg-0+deb12u122.01+really26.01+dfsg-0+deb12u1 |
22.01+really26.02+dfsg-0+deb12u1 |
7zipDebian:13 |
All versions, plus listed versions 24.09+dfsg-825.00+dfsg-125.01+dfsg-125.01+dfsg-1~deb13u125.01+dfsg-1~deb13u1~bpo12+1 Show 22 moreShow less25.01+dfsg-1~deb13u225.01+dfsg-225.01+dfsg-325.01+dfsg-425.01+dfsg-526.00+dfsg-126.00+dfsg-226.00+dfsg-326.00+dfsg-426.00+dfsg-526.00+dfsg1-126.00+dfsg1-226.00+dfsg1-326.01+dfsg-126.01+dfsg-226.01+dfsg-326.02+dfsg-126.02+dfsg-226.02+dfsg-326.03+dfsg-126.03+dfsg-226.03+dfsg-3 |
None known |
7zipDebian:14 |
before 26.02+dfsg-1, plus listed versions 24.09+dfsg-825.00+dfsg-125.01+dfsg-125.01+dfsg-1~deb13u125.01+dfsg-1~deb13u1~bpo12+1 Show 16 moreShow less25.01+dfsg-1~deb13u225.01+dfsg-225.01+dfsg-325.01+dfsg-425.01+dfsg-526.00+dfsg-126.00+dfsg-226.00+dfsg-326.00+dfsg-426.00+dfsg-526.00+dfsg1-126.00+dfsg1-226.00+dfsg1-326.01+dfsg-126.01+dfsg-226.01+dfsg-3 |
26.02+dfsg-1 |
p7zipDebian:12 |
before 16.02+really26.02+dfsg-0+deb12u1, plus listed versions 16.02+dfsg-816.02+really25.01+dfsg-0+deb12u116.02+really26.01+dfsg-0+deb12u1 |
16.02+really26.02+dfsg-0+deb12u1 |
p7zipDebian:13 |
before 16.02+transitional.1 | 16.02+transitional.1 |
7zipSUSE:Linux Enterprise Server 16.0 |
before 26.02-160000.1.1 | 26.02-160000.1.1 |
7zipSUSE:Linux Enterprise Server for SAP applications 16.0 |
before 26.02-160000.1.1 | 26.02-160000.1.1 |
7zipSUSE:Linux Enterprise Module for Basesystem 15 SP7 |
before 26.02-150400.9.9.1 | 26.02-150400.9.9.1 |
7zipSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS |
before 26.02-150400.9.9.1 | 26.02-150400.9.9.1 |
7zipSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS |
before 26.02-150400.9.9.1 | 26.02-150400.9.9.1 |
Show 19 moreShow less
| Package | Affected | Fixed |
|---|---|---|
7zipSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS |
before 26.02-150400.9.9.1 | 26.02-150400.9.9.1 |
7zipSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS |
before 26.02-150400.9.9.1 | 26.02-150400.9.9.1 |
7zipSUSE:Linux Enterprise Server 15 SP4-LTSS |
before 26.02-150400.9.9.1 | 26.02-150400.9.9.1 |
7zipSUSE:Linux Enterprise Server 15 SP5-LTSS |
before 26.02-150400.9.9.1 | 26.02-150400.9.9.1 |
7zipSUSE:Linux Enterprise Server 15 SP6-LTSS |
before 26.02-150400.9.9.1 | 26.02-150400.9.9.1 |
7zipSUSE:Linux Enterprise Server for SAP Applications 15 SP4 |
before 26.02-150400.9.9.1 | 26.02-150400.9.9.1 |
7zipSUSE:Linux Enterprise Server for SAP Applications 15 SP5 |
before 26.02-150400.9.9.1 | 26.02-150400.9.9.1 |
7zipSUSE:Linux Enterprise Server for SAP Applications 15 SP6 |
before 26.02-150400.9.9.1 | 26.02-150400.9.9.1 |
p7zipUbuntu:14.04:LTS |
All versions, plus listed versions 9.20.1~dfsg.1-49.20.1~dfsg.1-4+deb7u1build0.14.04.19.20.1~dfsg.1-4+deb7u2build0.14.04.19.20.1~dfsg.1-4+deb7u3build0.14.04.1 |
None known |
p7zipUbuntu:16.04:LTS |
All versions, plus listed versions 9.20.1~dfsg.1-4.29.20.1~dfsg.1-4.2ubuntu0.1 |
None known |
p7zipUbuntu:18.04:LTS |
All versions, plus listed versions 16.02+dfsg-416.02+dfsg-516.02+dfsg-6 |
None known |
p7zipUbuntu:20.04:LTS |
All versions, plus listed versions 16.02+dfsg-716.02+dfsg-7build1 |
None known |
p7zipUbuntu:22.04:LTS |
All versions, plus listed versions 16.02+dfsg-8 |
None known |
7zipUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 21.03~beta+dfsg-621.04~beta+dfsg-121.06+dfsg-121.07+dfsg-121.07+dfsg-221.07+dfsg-321.07+dfsg-421.07+dfsg-4ubuntu0.1~esm1 |
None known |
7zipUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 23.01+dfsg-323.01+dfsg-723.01+dfsg-823.01+dfsg-1123.01+dfsg-11ubuntu0.1~esm1 |
None known |
7zipUbuntu:26.10 |
All versions, plus listed versions 26.00+dfsg-126.01+dfsg-226.01+dfsg-326.02+dfsg-126.02+dfsg-2 |
None known |
7zipUbuntu:26.04:LTS |
All versions, plus listed versions 25.01+dfsg-225.01+dfsg-325.01+dfsg-425.01+dfsg-526.00+dfsg-1 |
None known |
7zipopenSUSE:Tumbleweed |
before 26.02-1.1 | 26.02-1.1 |
7zipopenSUSE:Leap 16.0 |
before 26.02-160000.1.1 | 26.02-160000.1.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | 4minx/CVE-2026-14266 | 2026-07-22 |
| PoC in GitHub | liyuxuan504-byte/CVE-2026-14266 | 2026-07-25 |
| PoC in GitHub | ret2bilibili/CVE-2026-14266 | 2026-07-18 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-14266 is a high vulnerability (CVSS 7.0) in 7-zip, published July 21, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.74%, the 54th percentile. Fixed in 7zip 22.01+really26.02+dfsg-0+deb12u1.