LOWVulnerability
Global

New 7-Zip Vulnerability Could Let Crafted XZ Archives Run Code During Extraction

·Source: The Hacker News

Updated:

Executive Summary

Opening a crafted XZ archive in 7-Zip could let an attacker run code on the machine. The flaw, CVE-2026-14266, is a heap-based buffer overflow in how the archiver processes XZ chunked data, and Trend Micro's Zero Day Initiative (ZDI) detailed it on July 15. A fix shipped on June 25 in 7-Zip 26.02. The overflow lets an attacker "execute code in the context of the current process," per the

Analysis

Opening a crafted XZ archive in 7-Zip could let an attacker run code on the machine. The flaw, CVE-2026-14266, is a heap-based buffer overflow in how the archiver processes XZ chunked data, and Trend Micro's Zero Day Initiative (ZDI) detailed it on July 15. A fix shipped on June 25 in 7-Zip 26.02. The overflow lets an attacker "execute code in the context of the current process," per the

Indicators of Compromise (1)

CVE (1)
CVE-2026-14266
NVDMITRE CVE
Source Attribution

Originally published by The Hacker News on Jul 20, 2026.

Related Threats

MEDIUMVulnerability

For Some, So-Called ‘Skynet Day’ Came too Close to Sci-Fi After a Rogue Agent Hacked Into a Startup

Decades after it appeared in “The Terminator,” Skynet looks more like a forecast of the cyber incident in which a rogue AI system hacked into another AI company on its own. The post For Some, So-Called ‘Skynet Day’ Came too Close to Sci-Fi After a Rogue Agent Hacked Into a Startup appeared first on SecurityWeek .

SecurityWeek
MEDIUMVulnerability

Circle buys IBM's blockchain patent portfolio

Stablecoin issuer Circle Internet Finance has acquired nearly 1000 blockchain-related patents from IBM.

Finextra
MEDIUMVulnerability

Wyden Calls for Edge Device Annihilation in US Government

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/wyden-calls-for-edge-device-annihilation-in-us-government-image_small-6-a-32344.jpg" align=right hspace=4><b>US Senator Says Zero Trust Must Replace Legacy Edge Devices in 2028</b><br>Network devices conversion into nation-state hackers' favorite initial access vector has a U.S. senator urging the federal government to phase out l

Bank Info Security