Vulnerability-Lookup

CVE-2026-14266 (GCVE-0-2026-14266)

Vulnerability from cvelistv5 – Published: 2026-07-29 17:17 – Updated: 2026-07-30 03:55

Title

7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability

Summary

7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of XZ chunked data. Crafted XZ-compressed data can trigger an overflow of a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30169.

Severity

7 (High)


                        
                          CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-122 - Heap-based Buffer Overflow

Assigner

zdi

References

2 references

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

1 product

Vendor	Product	Version
7-Zip	7-Zip	Affected: 26.01

Date Public

2026-07-15 21:47

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-07-29T17:30:32.742Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/07/17/12"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-14266",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-29T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-30T03:55:31.679Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "7-Zip",
          "vendor": "7-Zip",
          "versions": [
            {
              "status": "affected",
              "version": "26.01"
            }
          ]
        }
      ],
      "dateAssigned": "2026-06-30T18:43:50.105Z",
      "datePublic": "2026-07-15T21:47:29.811Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the processing of XZ chunked data. Crafted XZ-compressed data can trigger an overflow of a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30169."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122: Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-29T17:17:13.649Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-26-444",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-444/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Lunbun LLC (Landon Peng)"
      },
      "title": "7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2026-14266",
    "datePublished": "2026-07-29T17:17:13.649Z",
    "dateReserved": "2026-06-30T18:43:50.027Z",
    "dateUpdated": "2026-07-30T03:55:31.679Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-14266",
      "date": "2026-08-09",
      "epss": "0.00939",
      "percentile": "0.5758"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-14266\",\"sourceIdentifier\":\"zdi-disclosures@trendmicro.com\",\"published\":\"2026-07-29T18:16:50.720\",\"lastModified\":\"2026-08-07T20:48:32.290\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\\n\\nThe specific flaw exists within the processing of XZ chunked data. Crafted XZ-compressed data can trigger an overflow of a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30169.\"}],\"affected\":[{\"source\":\"zdi-disclosures@trendmicro.com\",\"affectedData\":[{\"vendor\":\"7-Zip\",\"product\":\"7-Zip\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"26.01\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"cvssMetricV30\":[{\"source\":\"zdi-disclosures@trendmicro.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":7.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-29T00:00:00+00:00\",\"id\":\"CVE-2026-14266\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"zdi-disclosures@trendmicro.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-122\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:7-zip:7-zip:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"26.02\",\"matchCriteriaId\":\"FCB07733-189C-477A-B66A-548C42B39D26\"}]}]}],\"references\":[{\"url\":\"https://www.zerodayinitiative.com/advisories/ZDI-26-444/\",\"source\":\"zdi-disclosures@trendmicro.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2026/07/17/12\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2026-07-30T08:54:06+00:00",
      "cve": "CVE-2026-14266",
      "id": "CVE-2026-14266",
      "initial_release_date": "2026-07-29T17:17:13.649000+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "7-Zip: 7-Zip: Remote Code Execution via XZ decompression heap-based buffer overflow",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-14266.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-07-31T00:37:38Z",
      "cve": "CVE-2026-14266",
      "id": "CVE-2026-14266",
      "initial_release_date": "2026-07-31T00:37:38Z",
      "product_status:known_affected": "70",
      "product_status:recommended": "1",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-14266",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-14266.json",
      "version": "2"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://www.openwall.com/lists/oss-security/2026/07/17/12\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2026-07-29T17:30:32.742Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-14266\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-29T18:09:02.527655Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-29T18:09:07.535Z\"}}], \"cna\": {\"title\": \"7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability\", \"source\": {\"lang\": \"en\", \"value\": \"Lunbun LLC (Landon Peng)\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_0\": {\"version\": \"3.0\", \"baseScore\": 7, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H\"}}], \"affected\": [{\"vendor\": \"7-Zip\", \"product\": \"7-Zip\", \"versions\": [{\"status\": \"affected\", \"version\": \"26.01\"}], \"defaultStatus\": \"unknown\"}], \"datePublic\": \"2026-07-15T21:47:29.811Z\", \"references\": [{\"url\": \"https://www.zerodayinitiative.com/advisories/ZDI-26-444/\", \"name\": \"ZDI-26-444\", \"tags\": [\"x_research-advisory\"]}], \"dateAssigned\": \"2026-06-30T18:43:50.105Z\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\\n\\nThe specific flaw exists within the processing of XZ chunked data. Crafted XZ-compressed data can trigger an overflow of a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30169.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-122\", \"description\": \"CWE-122: Heap-based Buffer Overflow\"}]}], \"providerMetadata\": {\"orgId\": \"99f1926a-a320-47d8-bbb5-42feb611262e\", \"shortName\": \"zdi\", \"dateUpdated\": \"2026-07-29T17:17:13.649Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-14266\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-29T18:09:11.010Z\", \"dateReserved\": \"2026-06-30T18:43:50.027Z\", \"assignerOrgId\": \"99f1926a-a320-47d8-bbb5-42feb611262e\", \"datePublished\": \"2026-07-29T17:17:13.649Z\", \"assignerShortName\": \"zdi\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-836V-XV29-X32V

Vulnerability from github – Published: 2026-07-29 18:31 – Updated: 2026-07-29 18:31

Details

The specific flaw exists within the processing of XZ chunked data. Crafted XZ-compressed data can trigger an overflow of a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30169.

Severity

7.0 (High)


                  
                    CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-14266"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-122"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-29T18:16:50Z",
    "severity": "HIGH"
  },
  "details": "7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the processing of XZ chunked data. Crafted XZ-compressed data can trigger an overflow of a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30169.",
  "id": "GHSA-836v-xv29-x32v",
  "modified": "2026-07-29T18:31:40Z",
  "published": "2026-07-29T18:31:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14266"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-444"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/07/17/12"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

ubuntu-cve-2026-14266

Vulnerability from osv_ubuntu

Published

2026-07-29 18:16

Modified

2026-08-06 00:12

Summary

Details

Severity

7.0 (High)


                    
                      CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-14266	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-14266	REPORT
	https://www.zerodayinitiative.com/advisories/ZDI-…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "p7zip",
            "binary_version": "9.20.1~dfsg.1-4+deb7u3build0.14.04.1"
          },
          {
            "binary_name": "p7zip-full",
            "binary_version": "9.20.1~dfsg.1-4+deb7u3build0.14.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "p7zip",
        "purl": "pkg:deb/ubuntu/p7zip@9.20.1~dfsg.1-4+deb7u3build0.14.04.1?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "9.20.1~dfsg.1-4",
        "9.20.1~dfsg.1-4+deb7u1build0.14.04.1",
        "9.20.1~dfsg.1-4+deb7u2build0.14.04.1",
        "9.20.1~dfsg.1-4+deb7u3build0.14.04.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "p7zip",
            "binary_version": "9.20.1~dfsg.1-4.2ubuntu0.1"
          },
          {
            "binary_name": "p7zip-full",
            "binary_version": "9.20.1~dfsg.1-4.2ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "p7zip",
        "purl": "pkg:deb/ubuntu/p7zip@9.20.1~dfsg.1-4.2ubuntu0.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "9.20.1~dfsg.1-4.2",
        "9.20.1~dfsg.1-4.2ubuntu0.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "p7zip",
            "binary_version": "16.02+dfsg-6"
          },
          {
            "binary_name": "p7zip-full",
            "binary_version": "16.02+dfsg-6"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "p7zip",
        "purl": "pkg:deb/ubuntu/p7zip@16.02+dfsg-6?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "16.02+dfsg-4",
        "16.02+dfsg-5",
        "16.02+dfsg-6"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "p7zip",
            "binary_version": "16.02+dfsg-7build1"
          },
          {
            "binary_name": "p7zip-full",
            "binary_version": "16.02+dfsg-7build1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "p7zip",
        "purl": "pkg:deb/ubuntu/p7zip@16.02+dfsg-7build1?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "16.02+dfsg-7",
        "16.02+dfsg-7build1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "p7zip",
            "binary_version": "16.02+dfsg-8"
          },
          {
            "binary_name": "p7zip-full",
            "binary_version": "16.02+dfsg-8"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "p7zip",
        "purl": "pkg:deb/ubuntu/p7zip@16.02+dfsg-8?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "16.02+dfsg-8"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "7zip",
            "binary_version": "21.07+dfsg-4ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:22.04:LTS",
        "name": "7zip",
        "purl": "pkg:deb/ubuntu/7zip@21.07+dfsg-4ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "21.03~beta+dfsg-6",
        "21.04~beta+dfsg-1",
        "21.06+dfsg-1",
        "21.07+dfsg-1",
        "21.07+dfsg-2",
        "21.07+dfsg-3",
        "21.07+dfsg-4",
        "21.07+dfsg-4ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "7zip",
            "binary_version": "23.01+dfsg-11ubuntu0.1~esm1"
          },
          {
            "binary_name": "7zip-standalone",
            "binary_version": "23.01+dfsg-11ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:24.04:LTS",
        "name": "7zip",
        "purl": "pkg:deb/ubuntu/7zip@23.01+dfsg-11ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "23.01+dfsg-3",
        "23.01+dfsg-7",
        "23.01+dfsg-8",
        "23.01+dfsg-11",
        "23.01+dfsg-11ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "7zip",
            "binary_version": "26.00+dfsg-1"
          },
          {
            "binary_name": "7zip-standalone",
            "binary_version": "26.00+dfsg-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "7zip",
        "purl": "pkg:deb/ubuntu/7zip@26.00+dfsg-1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "25.01+dfsg-2",
        "25.01+dfsg-3",
        "25.01+dfsg-4",
        "25.01+dfsg-5",
        "26.00+dfsg-1"
      ]
    }
  ],
  "aliases": [],
  "details": "7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of XZ chunked data. Crafted XZ-compressed data can trigger an overflow of a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30169.",
  "id": "UBUNTU-CVE-2026-14266",
  "modified": "2026-08-06T00:12:16Z",
  "published": "2026-07-29T18:16:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-14266"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14266"
    },
    {
      "type": "REPORT",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-444/"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-14266"
  ]
}

WID-SEC-W-2026-2369

Vulnerability from csaf_certbund - Published: 2026-07-15 22:00 - Updated: 2026-08-05 22:00

Summary

7-Zip: Schwachstelle ermöglicht Codeausführung

Severity

Mittel

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: 7-Zip ist ein Extraktionsdienstprogramm für Archive, die im ZIP-Format komprimiert sind.

Angriff: Ein entfernter, anonymer Angreifer kann eine Schwachstelle in 7-Zip ausnutzen, um beliebigen Programmcode auszuführen.

Betroffene Betriebssysteme: - Linux - UNIX - Windows

CVE-2026-14266

Affected products

Known affected 4 products

Product	Identifier	Version
Open Source 7-Zip <26.02 Open Source / 7-Zip		<26.02
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
NetApp ActiveIQ Unified Manager for Microsoft Windows NetApp / ActiveIQ Unified Manager	`cpe:/a:netapp:active_iq_unified_manager:for_microsoft_windows`	for Microsoft Windows
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—

References

8 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://www.zerodayinitiative.com/advisories/ZDI-…	external
https://7-zip.de/index.html	external
https://lists.opensuse.org/archives/list/security…	external
https://security.netapp.com/advisory/NTAP-20260724-0010	external
https://lists.debian.org/debian-lts-announce/2026…	external
https://lists.debian.org/debian-lts-announce/2026…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "7-Zip ist ein Extraktionsdienstprogramm f\u00fcr Archive, die im ZIP-Format komprimiert sind.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in 7-Zip ausnutzen, um beliebigen Programmcode auszuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-2369 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2369.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-2369 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2369"
      },
      {
        "category": "external",
        "summary": "ZDI Advisory vom 2026-07-15",
        "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-444/"
      },
      {
        "category": "external",
        "summary": "7-zip Download vom 2026-07-15",
        "url": "https://7-zip.de/index.html"
      },
      {
        "category": "external",
        "summary": "openSUSE Security Update OPENSUSE-SU-2026:11319-1 vom 2026-07-22",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/CZO2O2HUULBI4UAEXBAWUNR4BC5XCWJW/"
      },
      {
        "category": "external",
        "summary": "NetApp Security Advisory NTAP-20260724-0010 vom 2026-07-24",
        "url": "https://security.netapp.com/advisory/NTAP-20260724-0010"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DLA-4719 vom 2026-08-05",
        "url": "https://lists.debian.org/debian-lts-announce/2026/08/msg00010.html"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DLA-4718 vom 2026-08-05",
        "url": "https://lists.debian.org/debian-lts-announce/2026/08/msg00009.html"
      }
    ],
    "source_lang": "en-US",
    "title": "7-Zip: Schwachstelle erm\u00f6glicht Codeausf\u00fchrung",
    "tracking": {
      "current_release_date": "2026-08-05T22:00:00.000+00:00",
      "generator": {
        "date": "2026-08-06T08:51:40.414+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-2369",
      "initial_release_date": "2026-07-15T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-07-15T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-07-22T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von openSUSE aufgenommen"
        },
        {
          "date": "2026-07-26T22:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von NetApp aufgenommen"
        },
        {
          "date": "2026-07-29T22:00:00.000+00:00",
          "number": "4",
          "summary": "Referenz(en) aufgenommen: EUVD-2026-50420"
        },
        {
          "date": "2026-08-05T22:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von Debian aufgenommen"
        }
      ],
      "status": "final",
      "version": "5"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Debian Linux",
            "product": {
              "name": "Debian Linux",
              "product_id": "2951",
              "product_identification_helper": {
                "cpe": "cpe:/o:debian:debian_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Debian"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "for Microsoft Windows",
                "product": {
                  "name": "NetApp ActiveIQ Unified Manager for Microsoft Windows",
                  "product_id": "T025631",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:netapp:active_iq_unified_manager:for_microsoft_windows"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "ActiveIQ Unified Manager"
          }
        ],
        "category": "vendor",
        "name": "NetApp"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c26.02",
                "product": {
                  "name": "Open Source 7-Zip \u003c26.02",
                  "product_id": "T056687"
                }
              },
              {
                "category": "product_version",
                "name": "26.02",
                "product": {
                  "name": "Open Source 7-Zip 26.02",
                  "product_id": "T056687-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:7-zip:7-zip:26.02"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "7-Zip"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "SUSE openSUSE",
            "product": {
              "name": "SUSE openSUSE",
              "product_id": "T055946",
              "product_identification_helper": {
                "cpe": "cpe:/o:suse:opensuse:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-14266",
      "product_status": {
        "known_affected": [
          "T056687",
          "2951",
          "T025631",
          "T055946"
        ]
      },
      "release_date": "2026-07-15T22:00:00.000+00:00",
      "title": "CVE-2026-14266"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-14266 (GCVE-0-2026-14266)

GHSA-836V-XV29-X32V

ubuntu-cve-2026-14266

Vulnerability from osv_ubuntu

WID-SEC-W-2026-2369

Tags

Sightings

Nomenclature