What is the CVSS score of CVE-2026-14266?

CVE-2026-14266 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.9%.

Which versions of 7-Zip are affected by CVE-2026-14266?

7-Zip compression utility contains a critical vulnerability enabling full system compromise when users open malicious archives.. A patch is available.

Is there a public PoC exploit available for CVE-2026-14266?

Yes, a public proof-of-concept exploit is available for CVE-2026-14266. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2026-14266?

Within 24 hours, identify all systems running 7-Zip 26.01 or earlier and direct users to avoid opening untrusted archive files pending remediation. Within 7 days, deploy 7-Zip version 26.02 to all affected systems, prioritizing workstations that process external file transfers or user-submitted archives. By day 30, complete a full compliance audit confirming 100% of 7-Zip installations have been updated and document the patch deployment timeline for regulatory records.

7-Zip CVE-2026-14266

EUVD-2026-50420 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-07-15 zdi

GHSA-836v-xv29-x32v

RCE Buffer Overflow Heap Overflow 7 Zip

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

File must be opened locally by the victim (AV:L, UI:R); no attacker privileges required to deliver the archive (PR:N); full process-level confidentiality, integrity, and availability impact (C/I/A:H).

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 07, 2026 - 20:59 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 07, 2026 - 20:52 vuln.today

cvss_changed

CVSS changed

Aug 07, 2026 - 20:52 NVD

7.0 (HIGH) 7.8 (HIGH)

Analysis Generated

Jul 17, 2026 - 13:45 vuln.today

CVE Published

Jul 15, 2026 - 00:00 cve.org

HIGH 7.0

DescriptionNVD

7-Zip contains a heap-based buffer overflow vulnerability in the handling of specially crafted XZ chunked data. Successful exploitation requires a victim to open a malicious archive containing a crafted XZ payload, allowing an attacker to execute arbitrary code in the context of the current process. Reported by Landon Peng of Lunbun LLC via the Zero Day Initiative; fixed in 7-Zip 26.02.

AnalysisAI

Heap-based buffer overflow in 7-Zip's XZ archive parser enables arbitrary code execution when a victim opens a crafted archive on 7-Zip 26.01 and earlier; fixed in 7-Zip 26.02. Reported by Landon Peng of Lunbun LLC through the Zero Day Initiative, this flaw carries full confidentiality, integrity, and availability impact at the process level. A public POC is confirmed available via the Italian ACN portal, though EPSS sits at only 0.92% (57th percentile) and no CISA KEV listing exists, indicating targeted rather than widespread exploitation at time of analysis.

Technical ContextAI

7-Zip's internal XZ decompression handler fails to properly validate boundary conditions when processing specially crafted XZ chunked data streams, resulting in a write beyond the bounds of a heap-allocated buffer (CWE-122, Heap-based Buffer Overflow). XZ is a lossless compression format built on LZMA2 that uses a block/chunk framing layer; the vulnerable code path is reached whenever 7-Zip encounters an XZ-compressed stream inside a supported archive container. Heap overflows of this class typically corrupt adjacent allocations, enabling controlled write primitives that can redirect execution flow. The affected product is unambiguously identified by CPE cpe:2.3:a:7-zip:7-zip:*:*:*:*:*:*:*:*, with EUVD data pinpointing version 26.01 as the last affected release.

RemediationAI

The primary fix is upgrading to 7-Zip 26.02, the vendor-released patch explicitly confirmed in the CVE description; obtain it from the official 7-Zip site. Where immediate upgrade is blocked by operational constraints, consider sandboxing archive-opening operations using OS-level isolation (Windows Sandbox, Firejail on Linux, or macOS App Sandbox), which limits the blast radius of a successful exploit to the sandboxed process rather than the full user session. As an additional gateway-level control, quarantining or rejecting inbound XZ-format archives (file extension .xz, MIME application/x-xz) at email or web proxy reduces exposure to phishing-delivered payloads, though this will break legitimate XZ archive workflows. Full advisory references: https://www.zerodayinitiative.com/advisories/ZDI-26-444/ and https://seclists.org/oss-sec/2026/q3/169.