CVE-2026-142667-zip Heap-based Buffer Overflow
NVDCVSS scored by NVD (NIST)
Vulnerability Summary
7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the processing of XZ chunked data. Crafted XZ-compressed data can trigger an overflow of a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30169.
The specific flaw exists within the processing of XZ chunked data. Crafted XZ-compressed data can trigger an overflow of a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30169.
CVSS v3.1 Base Metrics — Score 7.8 (HIGH)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HAttack VectorLocal
Attack ComplexityLow
Privileges RequiredNone
User InteractionRequired
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Affected & Patched Versions
- 7-zip 7-zip < 26.02
- 7-zip 7-zip 26.02
What to do
Plan remediation soon. No exploitation is confirmed yet, but the severity is high.
- Check whether you run 7-zip and which version.
- Update to a patched version listed above, then confirm the new version.
Timeline
- Jul 29, 2026Published
- Aug 7, 2026Record last modified
Score, severity and exploitation changes are tracked from the day Watchtower started logging them.
Get notified about new 7-zip CVEsYou are reading CVE-2026-14266. Get an email when KEV listings, exploits or new CVEs match your stack.
Set up CVE alertsRelated Coverage
More 7-zip CVEs
External References
Data last checked: Nov 15, 2026 16:06 UTC