7-Zip XZ Decoder RCE: Silent Patch Leaves Users Exposed

CVE-2026-14266 enables code execution via a crafted XZ archive. The fix landed in 7-Zip 26.02 on June 25, but the lack of automatic updates leaves most installations vulnerable.

On July 15, 2026, the Zero Day Initiative disclosed CVE-2026-14266, a heap-based buffer overflow in 7-Zip's XZ decoder that allows arbitrary code execution. The fix had been available since June 25 in version 26.02, twenty days before coordinated disclosure. The story isn't the flaw's technical severity — rated 7.0 High, not Critical — but the paradox of the "silent patch": a textbook coordinated disclosure that, due to how the software is distributed, fails to protect the users who need it.

Key Takeaways

CVE-2026-14266 is a heap-based buffer overflow in 7-Zip's XZ decoder with CVSS 7.0: local attack, high complexity, user interaction required
The bug resides in the MixCoder_Code function in C/XzDec.c, where the decoder passed the total buffer length on each iteration instead of the remaining space
The patch in 7-Zip 26.02, released June 25, 2026, subtracts bytes already written and halts processing if the total exceeds the allocation
7-Zip has no automatic update mechanism: most installations remain exposed despite the available fix

The Bug Mechanism: A Cascading Counting Error

The defect sits in the MixCoder_Code function in C/XzDec.c. When an XZ stream is processed through a decompression filter, the decoder received the total output buffer size on every call, not the portion actually remaining after previous writes.

Concretely: if the buffer is 4 KB and 2 KB were written in the first iteration, the second iteration still saw 4 KB available, not 2. When filtered output exceeded the real remaining space, the write continued past the heap allocation boundary, triggering a buffer overflow. The fix implements a running total of bytes written: version 26.02 subtracts that total and stops processing if the value exceeds the buffer size, as The Hacker News verified through source code review.

The vulnerable code has been present since at least version 21.07, dating to 2021. Rescana lists affected versions as: 21.07, 22.00, 22.01, 23.00, 23.01, 24.00, 24.01, 25.00, 25.01, 26.00, and 26.01. The presence of the code does not automatically mean all these versions are exploitable with equal reliability, but the exposure perimeter is broad and partly unknown.

"ZDI rates the flaw 7.0, or High, not the Critical several write-ups reached for." — The Hacker News

Why CVSS 7.0 High Isn't "Critical" and What Changes

ZDI's official assessment scores the vulnerability at 7.0, corresponding to High severity. The full CVSS 3.0 vector is AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H: local attack, high complexity, no privileges required, user interaction required, impact confined to the vulnerable process with confidentiality, integrity, and availability all compromised.

The distinction between High and Critical isn't semantic. The local vector (AV:L) and high complexity (AC:H) mean the attacker must already have specific conditions: typically, convincing the victim to download and open a malicious XZ archive. On Windows, 7-Zip also runs with a filtered standard-user token even when the user holds administrative privileges, limiting obtainable privileges to the current process context. Some outlets classified the flaw as Critical; the official ZDI data contradicts that overstatement.

As of July 20, 2026, The Hacker News found no public proof-of-concept exploits or credible reports of in-the-wild exploitation for CVE-2026-14266. The risk window, however, remains open for unpatched installations.

The Louder NTFS Flaw That Eclipsed the XZ Bug

In the same period, GitHub Security Lab disclosed GHSL-2026-140, a heap buffer overflow in 7-Zip's NTFS parser with CVSS 8.8. That related vulnerability — tracked as CVE-2026-48095 — garnered more media attention thanks to a working PoC demonstrating vtable hijacking.

The contrast between the two stories illuminates a systemic problem. Users who updated to 7-Zip 26.01 — the version that fixes NTFS but not XZ — may have gained a false sense of security, believing they had "fixed" recent vulnerabilities. The broader context, documented in GHSL-2026-115–122, shows memory-safety vulnerabilities across 7z, SquashFS, UDF, UEFI, WIM, and Ar formats, suggesting recurring patterns in the codebase rather than isolated incidents.

Researcher JarLob published a detailed exploit for the NTFS flaw leveraging a heap distance of roughly 304 bytes between _inBuf and the CInStream object. No public equivalent exists for the XZ decoder at this time.

What to Do Now

Priority actions follow directly from the verified facts:

Verify the installed 7-Zip version and manually update to 26.02 or later from the official site, since the software lacks automatic updates
Check for "set-and-forget" installations in enterprise environments, where 7-Zip is often deployed as a standard archiving utility without dedicated patch management
Assess third-party product integrations that incorporate 7-Zip libraries or components, as the dossier does not specify which require independent patches
Treat unexpected XZ archives from email or downloads with caution, recognizing the attack vector requires user interaction via file opening

The Lesson of Coordinated Disclosure That Doesn't Coordinate Users

The official timeline is technically flawless: researcher Landon Peng of Lunbun LLC reported the bug on June 5, 2026, the vendor released the fix on June 25, and ZDI published the advisory on July 15. Twenty days of lead time represents effective coordinated disclosure in vendor-security communication.

Yet 7-Zip's distribution model turns this relative success into an absolute problem. The absence of an automatic update channel, lack of in-app notification, and reliance on manual downloads from the official site create a discontinuity between the patch's technical availability and actual protection of the installed base. For ubiquitous software like 7-Zip — present in enterprise environments, embedded in third-party tools, often invisible in asset inventories — this discontinuity is the dominant risk.

The dossier does not specify how many users are actually protected by version 26.02, nor does it document alternative mitigations for installations that cannot be updated quickly. The impact on non-Windows platforms in terms of privilege model is not quantified. These gaps leave open questions about the true extent of the exposure perimeter, beyond the technical certainty of the vulnerability mechanism.

Information verified against cited sources and current as of publication.

Sources

Sources and references