CVE-2026-14266

Name of the Vulnerable Software and Affected Versions 7-Zip versions prior to 26.02

Description A heap-based buffer overflow exists in the XZ decompression component, specifically within the MixCoder Code() function. This issue occurs during the processing of XZ chunked data when the decoder fails to properly validate boundaries, passing the full buffer size instead of subtracting the space already filled. This leads to an out-of-bounds write in dynamic memory. A remote attacker can exploit this by enticing a user to open a specially crafted XZ archive or visit a malicious webpage. Successful exploitation allows the attacker to execute arbitrary code in the context of the current process with the same privileges as the application. A heap-based buffer overflow is a memory corruption issue that occurs when data written to a buffer exceeds its allocated space.

Recommendations Update to version 26.02 or newer.