7-Zip Discloses Heap Overflow Vulnerability Allowing Code Execution

A heap-based buffer overflow vulnerability, CVE-2026-14266, has been revealed in 7-Zip's handling of XZ compressed data. This flaw could enable an attacker to execute arbitrary code by tricking a user into opening a specially crafted XZ archive. Although it requires user interaction and a local attack vector, users are advised to update to 7-Zip version 26.02, which includes a fix released in June.