CVE-2026-14266 is a heap-based buffer overflow vulnerability in 7-Zip's XZ decompression functionality. An attacker can craft malicious XZ-compressed data that causes a heap overflow when processed by vulnerable versions of 7-Zip. Successful exploitation enables arbitrary code execution within the context of the current process. Exploitation requires user interaction (e.g., opening a malicious file). The vulnerability was reported to the vendor on 2026-06-05 and publicly disclosed on 2026-07-15. A fix is available in 7-Zip 26.02.

Remote attackers can execute arbitrary code on affected systems by leveraging this vulnerability, potentially leading to full compromise of the affected process. The attack requires user interaction, limiting automatic exploitation. The vulnerability affects confidentiality, integrity, and availability of the affected system as indicated by the CVSS vector (C:H/I:H/A:H).

Upgrade 7-Zip to version 26.02 or later, where this vulnerability has been fixed. Until the update is applied, avoid opening untrusted XZ-compressed files or visiting untrusted web pages that may deliver malicious compressed data.