ZDI-CAN-30169: ZDI-26-444: 7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of XZ chunked data. Crafted XZ-compressed data can trigger an overflow of a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
Other sources
This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.0. The following CVEs are assigned: CVE-2026-14266.
— ZDI
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Mitigate CVE-2026-14266 (ZDI-26-444) by preventing users from visiting malicious pages or opening malicious files that could deliver crafted XZ-compressed data to 7-Zip for processing.
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-30169?
The severity of ZDI-CAN-30169 is rated as high with a score of 7.
How do I fix ZDI-CAN-30169?
To fix ZDI-CAN-30169, update to the latest version of 7-Zip that addresses this vulnerability.
What type of vulnerability is ZDI-CAN-30169?
ZDI-CAN-30169 is a heap-based buffer overflow vulnerability that can lead to remote code execution.
What software is affected by ZDI-CAN-30169?
ZDI-CAN-30169 affects installations of 7-Zip.
What user actions are required to exploit ZDI-CAN-30169?
Exploitation of ZDI-CAN-30169 requires user interaction, such as visiting a malicious page or opening a malicious file.