CVE-2026-14266: Critical 7-Zip Heap Overflow via XZ Archives
Hey everyone,
Just saw the ZDI report regarding CVE-2026-14266. It’s a heap-based buffer overflow affecting 7-Zip when processing specifically crafted XZ archives containing chunked data.
According to the details released on July 15 (though the fix shipped in v26.02 on June 25), the flaw allows an attacker to execute code in the context of the current process. Given that 7-Zip is ubiquitous on admin workstations and often used on servers for decompression, this is a high-value vector for initial access or lateral movement.
The overflow occurs because the application fails to properly validate the size of the XZ chunk data before copying it into a buffer. If you are handling archives from untrusted sources, this is a must-patch.
I’ve whipped up a quick PowerShell snippet to check your current version against the patched 26.02:
$regPath = "HKLM:\Software\7-Zip"
if (Test-Path $regPath) {
$path = (Get-ItemProperty $regPath).Path64
if ($path) {
$ver = (Get-Item "$path\7z.exe").VersionInfo.FileVersion
Write-Host "Current Version: $ver"
if ([version]$ver -lt [version]"26.02") {
Write-Host "[!] VULNERABLE" -ForegroundColor Red
} else {
Write-Host "[+] Patched" -ForegroundColor Green
}
}
}
Has anyone seen active exploitation targeting XZ files specifically in the wild yet? I feel like we usually see the standard ZIP or RAR vectors more often.
Great catch posting this. While heap overflows are notoriously difficult to exploit reliably on modern Windows due to mitigations like ASLR and CFG, 7-Zip often doesn't enable all the rigorous compiler flags that browsers do. I'd treat this as highly reliable for a local privilege escalation scenario if the user is an admin.
Thanks for the script, rolling this out via SCCM immediately. We've been trying to standardize on Windows built-in compression (tar/gzip via cmd) to reduce dependency bloat, but 7-Zip remains sticky in our DevOps pipelines due to the CLI syntax. This is a good reminder to audit our CI/CD runners as well.
From a detection perspective, signature-based scanning on the archive itself is going to be a cat-and-mouse game. I'd recommend looking for suspicious child processes spawned by 7zFM.exe or 7z.exe.
Here is a basic KQL query for advanced hunting if you're using Defender:
ProcessCreationEvents
| where InitiatingProcessFileName in~ ("7z.exe", "7zFM.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe")
Verified Access Required
To maintain the integrity of our intelligence feeds, only verified partners and security professionals can post replies.
Request Access