SECURITYJul 20 · 09:10 UTCTHE HACKER NEWS[email protected] (The Hacker News)

New 7-Zip Vulnerability Could Let Crafted XZ Archives Run Code During Extraction

A new vulnerability in 7-Zip (CVE-2026-14266) allows code execution when processing crafted XZ archives due to a heap-based buffer overflow. Trend Micro's Zero Day Initiative disclosed the flaw on July 15, and a fix was released in 7-Zip 26.02 on June 25.

Nexus surfaces and summarizes. The full story lives at the source.

Mentioned

7-ZiporganizationTrend Micro's Zero Day InitiativeorganizationCVE-2026-14266topicheap-based buffer overflowtopicXZ archivestopiccode executiontopic

Spot something wrong with this article?Report a problem →

Forward this

Related Signal

Adjacent reporting

SECURITYJul 18 · 19:32 UTC
Update now: 7-Zip fixes RCE flaw exploitable with malicious archives
SECURITYMay 7 · 13:34 UTC
PAN-OS RCE Exploit Under Active Use Enabling Root Access and Espionage
SECURITYMay 6 · 06:14 UTC
Palo Alto PAN-OS Flaw Under Active Exploitation Enables Remote Code Execution
SECURITYApr 29 · 12:41 UTC
GitHub fixes RCE flaw that gave access to millions of private repos
SECURITYApr 21 · 10:22 UTC
Google Patches Antigravity IDE Flaw Enabling Prompt Injection Code Execution