CVE-2026-14266 7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability

High 7.0 Published 29 Jul 2026 Updated 30 Jul 2026

Remote attackers can execute arbitrary code by tricking users into opening malicious XZ-compressed files in 7-Zip.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-14266?

CVE-2026-14266 is a high-severity memory corruption vulnerability in 7-Zip, published on 29 Jul 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the processing of XZ chunked data. Crafted XZ-compressed data can trigger an overflow of a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30169.

Weakness: CWE-122

Which versions are affected by CVE-2026-14266?

It affects 1 product.

Linux distribution packages (15)

`7zip` SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS	All versions	`26.02-150400.9.9.1`
`7zip` SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS	All versions	`26.02-150400.9.9.1`
`7zip` SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS	All versions	`26.02-150400.9.9.1`
`7zip` SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS	All versions	`26.02-150400.9.9.1`
`7zip` SUSE:Linux Enterprise Module for Basesystem 15 SP7	All versions	`26.02-150400.9.9.1`
`7zip` SUSE:Linux Enterprise Server 15 SP4-LTSS	All versions	`26.02-150400.9.9.1`
`7zip` SUSE:Linux Enterprise Server 15 SP5-LTSS	All versions	`26.02-150400.9.9.1`
`7zip` SUSE:Linux Enterprise Server 15 SP6-LTSS	All versions	`26.02-150400.9.9.1`
`7zip` SUSE:Linux Enterprise Server 16.0	All versions	`26.02-160000.1.1`
`7zip` SUSE:Linux Enterprise Server for SAP Applications 15 SP4	All versions	`26.02-150400.9.9.1`
`7zip` SUSE:Linux Enterprise Server for SAP Applications 15 SP5	All versions	`26.02-150400.9.9.1`
`7zip` SUSE:Linux Enterprise Server for SAP Applications 15 SP6	All versions	`26.02-150400.9.9.1`
`7zip` SUSE:Linux Enterprise Server for SAP applications 16.0	All versions	`26.02-160000.1.1`
`7zip` openSUSE:Leap 16.0	All versions	`26.02-160000.1.1`
`7zip` openSUSE:Tumbleweed	All versions	`26.02-1.1`

Products include 7-Zip 7-Zip.

How do I fix CVE-2026-14266?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-14266 being exploited?

There is no known exploitation of CVE-2026-14266 in the wild and no public exploit code.

Public exploit code: 3 proofs of concept on GitHub.

Sources

Also known as DEBIAN-CVE-2026-14266, ECHO-0d1c-e83c-8090, GHSA-836v-xv29-x32v, MINI-4qhf-r3gc-9xrm, SUSE-SU-2026:23317-1, SUSE-SU-2026:3869-1 and 3 more.