New 7-Zip Vulnerability Could Let Crafted XZ Archives Run Code During Extraction

Opening a crafted XZ archive in 7-Zip could let an attacker run code on the machine. The flaw, CVE-2026-14266, is a heap-based buffer overflow in how the archiver processes XZ chunked data, and Trend Micro's Zero Day Initiative (ZDI) detailed it on July 15. A fix shipped on June 25 in 7-Zip 26.02. The overflow lets an attacker "execute code in the context of the current process," per the

The article reports a vulnerability in 7-Zip (CVE-2026-14266), a heap-based buffer overflow in the handling of crafted XZ chunked data that can allow arbitrary code execution when a user opens a malicious archive or visits a webpage delivering such data.[1][2][6][10] The flaw affects versions prior to 7-Zip 26.02, which was released on June 25, 2026 with a fix, and has a CVSS score of 7.0 with user interaction required and no public exploitation reported at disclosure time.[1][7][8][10] From a RealGround perspective, this is a software supply-chain risk for AI environments that rely on 7-Zip for automated data ingestion, backup handling, or model asset packaging: a compromised archive tool on an AI host or CI/CD pipeline can become an execution foothold to tamper with models, training data, or agent code. Organizations should treat compression and archiving utilities as part of their AI supply chain, ensure timely patching, and reflect such components in SBOMs and AI environment hardening to prevent archive-based RCE from cascading into AI system compromise.