New 7-Zip Vulnerability Could Let Crafted XZ Archives Run Code During Extraction

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2026-07-20 09:10 UTC
Importiert: 2026-07-25 11:05 UTC
Quelle-ID: thn_global
uid_hash: 09690cc84efe17d466267e59e89e8be81c98ba6d6a869590ac1b3f3710587610

The Hacker News

Inhalt

Opening a crafted XZ archive in 7-Zip could let an attacker run code on the machine. The flaw, CVE-2026-14266, is a heap-based buffer overflow in how the archiver processes XZ chunked data, and Trend Micro's Zero Day Initiative (ZDI) detailed it on July 15. A fix shipped on June 25 in 7-Zip 26.02.

The overflow lets an attacker "execute code in the context of the current process," per the

Verknuepfte CVEs

CVE-ID	Severity (Quelle)	CVSS (Quelle)	Severity (CVE.org)	CVSS (CVE.org)	EPSS	EPSS-Pctl	Veroeffentlicht (CVE.org)
CVE-2026-14266			HIGH	7			2026-07-29

Quellen-Details

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
The Hacker News	thn_global	security_news		-	de	https://feeds.feedburner.com/TheHackersNews

Zurueck zur Eintrags-Liste