New 7-Zip Vulnerability Could Let Crafted XZ Archives Run Code During Extraction

A vulnerability in 7-Zip has been discovered that could allow an attacker to run code on a machine when a crafted XZ archive is opened. The issue is a heap-based buffer overflow related to the processing of XZ chunked data. This flaw has been assigned the identifier CVE-2026-14266 and was detailed by Trend Micro's Zero Day Initiative. The buffer overflow enables an attacker to execute code within the context of the current process. A fix for this issue was included in 7-Zip version 26.02, which was released on June 25.