Ethical Hacking News
A recent vulnerability in 7-Zip's XZ archive processing mechanism has raised concerns among cybersecurity experts and users alike. This heap-based buffer overflow allows an attacker to execute code with elevated privileges, albeit under specific circumstances. To protect against this threat, we recommend updating to the latest version of 7-Zip immediately. The vulnerable software has a patch available, which was released before the advisory became public, ensuring that systems updated in time are already secure.
A recently discovered heap-based buffer overflow in 7-Zip's XZ chunked data processing mechanism allows an attacker to execute code with elevated privileges under specific circumstances.The vulnerability, marked as CVE-2026-14266, can be exploited through a local attack vector, making reliable exploitation challenging.The ZDI rates this vulnerability as High but not Critical, and the CVSS 3.0 vector indicates AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H.A patch was released on June 25 for 7-Zip version 26.02, which fixes all identified issues including CVE-2026-48095 and this particular XZ flaw.It is recommended to update to the latest version of 7-Zip as soon as possible to protect against this threat.
THN has obtained information regarding a recent vulnerability in 7-Zip, a widely used file archiver software, which allows an attacker to execute code on the machine with elevated privileges. The identified issue is attributed to a heap-based buffer overflow in the XZ chunked data processing mechanism of the archiver. It was discovered by Trend Micro's Zero Day Initiative (ZDI) and is marked as CVE-2026-14266.
According to the advisory, this vulnerability allows an attacker to execute code in the context of the current process, with limited privileges since it runs under a filtered standard-user token on Windows even for administrator accounts. However, exploiting this flaw requires a local attack vector rather than network-reachable or no-click attacks. As such, reliable exploitation of this vulnerability is challenging.
The ZDI rates this vulnerability as High but not Critical. It also provides details about the CVSS 3.0 vector, which indicates AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. The attack complexity is described as "remote code execution," implying that a remote attacker must deliver the file to the victim in some way, such as through email, a download, or a web page that hands it over to 7-Zip.
The Hacker News compared the XZ decoder source across various releases and found no public proof-of-concept for this bug as of July 20, 2026. Moreover, there were no credible reports of exploitation in the wild during this period.
This vulnerability is part of a series of memory-safety bugs discovered in 7-Zip's archive handlers. A patch was shipped on June 25, 7-Zip version 26.02, which fixes all the identified issues including CVE-2026-48095. The fix for this particular XZ flaw also appears in 7-Zip releases back to at least version 21.07 (2021).
Given that the patch was released before the advisory became public, any systems updated with the newer version would already be secure before the details of the vulnerability were known. Therefore, it is recommended for users to update to 7-Zip 26.02 or later on every machine that opens archives from outside their control.
In conclusion, a recently discovered heap-based buffer overflow in 7-Zip's XZ chunked data processing mechanism poses a significant threat to its users. It allows an attacker to execute code with elevated privileges under specific circumstances, albeit with limited rights when run through a standard-user token on Windows. Users are advised to update their systems to the latest version of 7-Zip as soon as possible.
A recent vulnerability in 7-Zip's XZ archive processing mechanism has raised concerns among cybersecurity experts and users alike. This heap-based buffer overflow allows an attacker to execute code with elevated privileges, albeit under specific circumstances. To protect against this threat, we recommend updating to the latest version of 7-Zip immediately. The vulnerable software has a patch available, which was released before the advisory became public, ensuring that systems updated in time are already secure.
Related Information:
https://www.ethicalhackingnews.com/articles/New-XZ-Archive-Vulnerability-Exposed-A-Growing-Concern-for-7-Zip-Users-ehn.shtml
https://thehackernews.com/2026/07/new-7-zip-vulnerability-could-let.html
https://nvd.nist.gov/vuln/detail/CVE-2026-14266
https://www.cvedetails.com/cve/CVE-2026-14266/
https://nvd.nist.gov/vuln/detail/CVE-2026-48095
https://www.cvedetails.com/cve/CVE-2026-48095/
Published: Mon Jul 20 05:40:28 2026 by llama3.2 3B Q4_K_M
