ZDI-26-444: 7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of XZ chunked data. Crafted XZ-compressed data can trigger an overflow of a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
Other sources
This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.0. The following CVEs are assigned: CVE-2026-14266.
— ZDI
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch ZDI-26-444 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2026-14266
Event History
Frequently Asked Questions
What is the severity of ZDI-26-444?
The severity of ZDI-26-444 is rated with a CVSS score of 7.0, indicating a high risk.
How do I fix ZDI-26-444?
To fix ZDI-26-444, ensure you upgrade to the latest version of 7-Zip that contains the security patch.
What type of vulnerability is ZDI-26-444?
ZDI-26-444 is a heap-based buffer overflow vulnerability that allows remote code execution.
Is user interaction required to exploit ZDI-26-444?
Yes, user interaction is required as the target must either visit a malicious page or open a malicious file.
Which software versions are affected by ZDI-26-444?
ZDI-26-444 affects installations of 7-Zip prior to the implementation of the security fixes.