www.it-connect.fr
7-Zip Vulnerability: Why You Should Install Version 26.02 Now
The latest version of 7-Zip, numbered 26.02, fixes a security flaw that could allow arbitrary code execution on machines running the software. Tracked as CVE-2026-14266, it affects the handling of compressed data in XZ format. Here’s what you need to know about this vulnerability.
Disclosed through the Zero Day Initiative (ZDI) on July 15, 2026, this vulnerability was discovered by Landon Peng. It affects 7-Zip, the well-known file compression and archiving tool used by millions of people worldwide, especially on Windows.
That said, this vulnerability, tracked as CVE-2026-14266, has already been patched for nearly a month. In fact, the security fix was included in 7-Zip 26.02, a version available since June 25, 2026. Wait, Florina, why didn’t you tell us sooner? Because the release note published on GitHub only mentioned that bugs and vulnerabilities had been fixed, with no further details. But now, we know a little more.
A Flaw in XZ Data Decoding
According to the bulletin published by the Zero Day Initiative, the security flaw lies in the way 7-Zip processes XZ data split into blocks. Specifically crafted XZ data can trigger a heap-based buffer overflow, opening the door to code execution in the context of the current process.
For the record, XZ is a file compression format based on the LZMA2 algorithm. It is fairly common in Linux and Unix environments, where it is used in particular to reduce the size of archives (the .tar.xz files).
The vulnerability has a CVSS score of 7.0 out of 10, and exploiting it requires user interaction. In other words, the victim must open a malicious file or visit a booby-trapped page to trigger the attack. This is therefore not a remotely exploitable flaw without victim action. That is often the case with file-related vulnerabilities: opening the booby-trapped file is what triggers the flaw.
From now on, you need to update 7-Zip on your machine! As a reminder, this application does not include any automatic update mechanism. The fix will therefore not be deployed on its own on your PC (unless you use a suitable tool to manage your updates).
Why so much attention for an archiving utility? Because 7-Zip is among the most widely used software on Windows, making it a prime target for cybercriminals. A phishing campaign or social engineering operation could very well distribute a booby-trapped archive exploiting this type of flaw to install malware. This is not the first time the software has been affected either: in October 2025, two path traversal vulnerabilities had already been fixed in 7-Zip.
To date, no active exploitation of CVE-2026-14266 has been reported.
