Full research report
Update now: 7-Zip fixes RCE flaw exploitable with malicious archives
Executive assessment
The headline story concerns CVE-2026-14266, a heap-based buffer overflow in 7-Zip's XZ decompression handler, disclosed by researcher Landon Peng through the Zero Day Initiative (ZDI-26-444, 15 July 2026) and patched in 7-Zip 26.02. A material data-quality issue is present in the source material: CVE-2025-8088, cited in the prompt's CVE and CISA KEV fields, is a WinRAR path traversal flaw actively exploited by state-aligned actors in 2025 — it is wholly unrelated to 7-Zip, and the BleepingComputer article itself uses it only as historical context. No active exploitation of CVE-2026-14266 was confirmed across all verified sources, and no public proof-of-concept was found, though the absence of auto-update in 7-Zip and the tool's ubiquity on Windows mean a large population of vulnerable installations will persist without active patching. The CVSS 7.0 vector (AV:L/AC:H) reflects meaningful exploitation complexity that reduces immediate mass-exploitation risk, but the precedent of archive-format vulnerabilities being weaponised in phishing and ransomware delivery makes prompt patching a high priority.
What happened
On 18 July 2026, BleepingComputer reported that 7-Zip had released version 26.02 to address a heap-based buffer overflow in its XZ decompression handler, tracked as CVE-2026-14266. The flaw was reported on 5 June 2026 by researcher Landon Peng of Lunbun LLC through coordinated disclosure with the Zero Day Initiative, which published advisory ZDI-26-444 on 15 July 2026. The patch adds output-buffer boundary checks to the XZ decoder, preventing writes beyond allocated heap space. No active exploitation or public proof-of-concept has been confirmed at the time of disclosure.
Affected scope
All 7-Zip versions prior to 26.02 that process XZ-compressed data. 7-Zip is among the most widely deployed archive utilities on Windows, producing a large unpatched population given the absence of any automatic update mechanism.
Technical assessment
CVE-2026-14266 is a heap-based buffer overflow in 7-Zip's XZ-format decompression handler. The decoder failed to enforce a limit on how much data it could write to the output buffer, allowing a specially crafted XZ stream to overflow heap memory. Successful exploitation requires a user to open a malicious archive or visit a page that triggers 7-Zip processing of the crafted payload, placing this vulnerability firmly in phishing and social-engineering delivery chains rather than enabling unauthenticated remote exploitation. The CVSS vector (AV:L/AC:H) reflects that reliable exploitation is technically complex, though the enormous install base makes opportunistic targeting attractive once reliable techniques are developed.
Recommended defensive actions
- Update 7-Zip to version 26.02 immediately via manual download from 7-zip.org or a package manager such as winget; no automatic update exists so manual action is required for every affected host
- Apply email and web-gateway controls to inspect and quarantine compressed archives — particularly .xz, .7z and polyglot files — from untrusted or external senders
- Implement endpoint behavioural rules to alert on anomalous child-process spawning or unexpected network activity originating from 7zG.exe or 7z.exe, as a compensating control where patching is delayed
Uncertainties and evidence gaps
- CVE-2026-14266 holds RESERVED status at NVD as of the investigation date; no official CVSS vector or CWE classification has been published by NVD, making the ZDI advisory the sole primary scoring reference
- One AI-generated search-result summary claimed a Python proof-of-concept exists; this could not be corroborated by any primary or independently verified source and is assessed as unreliable
- The source material associated CVE-2025-8088 — a CISA KEV-confirmed, actively exploited WinRAR path traversal flaw — with this 7-Zip story; this is a data attribution error; the two vulnerabilities are unrelated
- Exposure on non-Windows platforms (Linux, macOS 7-Zip ports) is not addressed in available advisories
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
No active in-the-wild exploitation of CVE-2026-14266 confirmed at time of disclosure; no public proof-of-concept verified. Note: CVE-2025-8088 cited in the source material header is a WinRAR path traversal flaw (CISA KEV, actively exploited 2025), unrelated to this 7-Zip story.
Investigation began by identifying a discrepancy in the source material: CVE-2025-8088 was associated with a 7-Zip story, yet the article text treated it as a WinRAR precedent. Parallel searches and NVD verification confirmed CVE-2025-8088 is a WinRAR path traversal flaw (CISA KEV-confirmed, exploited in 2025), while the actual 7-Zip XZ flaw is CVE-2026-14266, documented in ZDI advisory ZDI-26-444. Further fetches of primary and secondary sources established no active exploitation and no confirmed public proof-of-concept at disclosure.
- What is CVE-2025-8088 and does it relate to 7-Zip?Searched for CVE-2025-8088 WinRAR vulnerability 2025
CVE-2025-8088 is a WinRAR path traversal (ADS-based arbitrary file write) vulnerability affecting WinRAR ≤7.12; CISA KEV-confirmed as actively exploited from July 2025 by Russian and Chinese threat actors; no connection to 7-Zip
why Established that the CVE in the source material header is for a different product; the 7-Zip story requires identifying a separate CVE
- What CVE tracks the new 7-Zip XZ heap overflow?Searched for 7-Zip 26.02 RCE XZ heap buffer overflow vulnerability 2026
Multiple sources identify CVE-2026-14266 as the XZ decompression heap overflow fixed in 7-Zip 26.02; ZDI advisory ZDI-26-444 is the coordinating reference; reported by Landon Peng of Lunbun LLC
why Identified the correct CVE for the headline story and located the primary advisory to verify
- Is CVE-2026-14266 present in NVD with official scoring?Fetched NVD detail page for CVE-2026-14266nvd.nist.gov ↗
CVE-2026-14266 is in RESERVED status at NVD; no description, CVSS or CWE published
why Limits reliance on NVD; ZDI becomes the sole primary scoring reference for CVSS 7.0
- Does NVD confirm CVE-2025-8088 is a WinRAR flaw?Fetched NVD detail page for CVE-2025-8088nvd.nist.gov ↗
CVE-2025-8088 confirmed as WinRAR path traversal; CVSS 3.1 8.8 HIGH; WinRAR ≤7.12 affected; CISA KEV added 2025-08-12
why Definitively rules out any 7-Zip connection for CVE-2025-8088 and confirms the source-material attribution error
- What are the authoritative technical details of CVE-2026-14266?Fetched ZDI advisory ZDI-26-444zerodayinitiative.com ↗
Confirms CVE-2026-14266 in 7-Zip prior to 26.02; CVSS 7.0 (AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H); crafted XZ chunked data triggers heap buffer overflow; coordinated disclosure completed 15 July 2026
why Primary advisory provides authoritative CVSS vector, affected version range, and confirmed fix version
- What does the BleepingComputer article say about the CVE and exploitation status?Fetched BleepingComputer articlebleepingcomputer.com ↗
Article does not state a CVE number; references ZDI-26-444; explicitly frames CVE-2025-8088 as historical WinRAR context; states no active exploitation of the new 7-Zip flaw confirmed
why Confirms the source-material CVE header was an attribution error; exploitation-status claim (no active exploitation) is now sourced from primary reporting
- Is there a confirmed public proof-of-concept for CVE-2026-14266?Searched for CVE-2026-14266 proof of concept exploit 2026 and fetched VulnCheck XDBvulncheck.com ↗
CVE-2026-14266 not listed in VulnCheck XDB; one AI-generated search-result summary claimed a Python PoC but the claim was not present in any primary source or independently verified article
why Absence from VulnCheck XDB and absence of PoC mention in cybersecuritynews and BleepingComputer supports an assessment of no confirmed public PoC
- Does an independent secondary source corroborate CVE, affected scope and PoC status?Fetched CybersecurityNews article on 7-Zip CVE-2026-14266cybersecuritynews.com ↗
Confirms CVE-2026-14266; all 7-Zip versions prior to 26.02 affected; user interaction required; no PoC mentioned
why Second independent verified source corroborating core facts; no PoC mention across both independent sources raises confidence that no public PoC existed at disclosure
Research coverage
All 68 registered source leaves were evaluated for this run: 60 completed, 0 were unavailable, 1 failed and 7 were disabled. For this story, 4 registered sources supplied useful evidence (3 primary, 0 corroborating, 1 contextual and 0 PoC/exploit references). 56 completed sources contained no matched information for this story.
Complete source-by-source audit 68 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| BleepingComputernews | ok4 records | Primary evidence2 matched items | Published the source report used to frame and date the event. Supplied independent analysis opened and verified during focused research. |
| CISA KEVkev | ok1647 records | Primary evidence1 matched items | Confirmed that a related CVE is listed in CISA's Known Exploited Vulnerabilities catalogue. |
| NVDcve | ok900 records | Primary evidence1 matched items | Supplied a vendor or government advisory opened and verified during focused research. |
| FIRST EPSSepss | ok | Context1 matched items | Added exploitation-probability context; EPSS does not itself prove exploitation. |
| AlienVault OTXdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CISA Alertsnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Cisco PSIRTvendor_advisory | stale fallback0 records | Failed | The current collection attempt failed; this source cannot support the report. |
| Cisco Talosnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok257 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok661 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1005 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| DNSDumpster domain IOC enrichmentresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Exploit-DBexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok12 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok2 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Mastodon #vulnerabilityresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Microsoft MSRCvendor_advisory | ok1583 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP Galaxyresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Rapid7news | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shodanresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sigma Rulesresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sophos IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| The Hacker Newsnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 5 opened outside the registered collection
Vulnerability & exploitation2
Vendor & gov advisories3
Primary coordinating advisory; confirms CVE-2026-14266, CVSS 7.0 (AV:L/AC:H/PR:N/UI:R), fixed in 7-Zip 26.02, disclosed 15 July 2026
Confirms CVE-2025-8088 is a WinRAR path traversal flaw (CVSS 3.1: 8.8), not a 7-Zip issue; included to document the source-material attribution error
Separate 7-Zip NTFS handler overflow fixed in 26.01; establishes a pattern of heap-overflow findings in the 7-Zip 26.x release cycle
Analysis & research2
Primary reporting; references ZDI-26-444; confirms no active exploitation; correctly frames CVE-2025-8088 as a WinRAR precedent, not the 7-Zip CVE
Independent corroboration; confirms CVE-2026-14266, affected scope (<26.02), user-interaction requirement, and no PoC mention