The well-known open source decompression software 7-Zip was recently exposed to have a high-risk security vulnerability. An attacker can remotely execute malicious code on the victim's system simply by inducing users to open a carefully constructed malicious compressed file. Since 7-Zip has long lacked an automatic update mechanism, users and system administrators must manually download and install the latest version to fix this vulnerability.
According to information disclosed by the "Zero-Day Project" of security agency Trend Micro, the vulnerability has been tracked as CVE-2026-14266 and is essentially a heap-based buffer overflow vulnerability. When the software is processing a specific XZ-compressed data stream, if it encounters a specially forged compressed package, it will cause an overflow, thus opening up a channel for the attacker to execute arbitrary code. The victim only needs to visit the web page containing the threat or open the archive in question, and the relevant code will directly gain the same permissions as the currently logged-in user and run.
The vulnerability was originally reported to the 7-Zip development team in early June this year by Lunbun researcher Landon Peng. With the efforts of all parties, the 7-Zip team quickly launched version 26.02 within a few weeks to close the security gap. However, the specific technical details of the vulnerability were not widely known until recently when ZDI publicly released a security bulletin. Given that 7-Zip is widely cross-platform and runs on multiple operating systems such as Windows, Linux, macOS, and BSD, the impact of this vulnerability is not limited to the traditional Windows user group.
As a popular lightweight archiving tool, 7-Zip has no built-in automatic update infrastructure in order to maintain extreme simplicity. The .xz format it supports is itself a container for compressed streams, evolved from the LZMA compression algorithm created earlier by 7-Zip developer Igor Pavlov. Since this software has been widely used on both consumer and server sides, many systems and command line tools rely on it to provide multi-format decompression support for free. This high popularity has also made it a key target for cybercriminals and security researchers. Security experts remind that for such key tools that lack automatic update functions, users must remember to remain highly vigilant and manually follow up version updates in a timely manner to prevent a single unfixed vulnerability from evolving into a larger-scale system security incident.
learn more:
https://www.zerodayinitiative.com/advisories/ZDI-26-444/