Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN767
_____________________________________________________________________

DATE                : 20/07/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running 7-Zip versions prior to 26.02.
 
=====================================================================
https://www.zerodayinitiative.com/advisories/ZDI-26-444/
https://sourceforge.net/p/sevenzip/discussion/45797/thread/b8d64839d0/
_____________________________________________________________________


7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code
Execution Vulnerability

July 15th, 2026
ZDI-26-444 ZDI-CAN-30169

CVE ID
CVE-2026-14266

CVSS Score
7.0 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Vendors
7-Zip

Affected Products
7-Zip


Vulnerability Details

This vulnerability allows remote attackers to execute arbitrary code on
affected installations of 7-Zip. User interaction is required to exploit
this vulnerability in that the target must visit a malicious page or
open a malicious file.

The specific flaw exists within the processing of XZ chunked data. Crafted
XZ-compressed data can trigger an overflow of a heap-based buffer. An
attacker can leverage this vulnerability to execute code in the context
of the current process.


Additional Details

Fixed in 7-Zip 26.02

Disclosure Timeline

    2026-06-05 - Vulnerability reported to vendor
    2026-07-15 - Coordinated public release of advisory
    2026-07-15 - Advisory Updated

Credit

Lunbun LLC (Landon Peng)

=========================================================

+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================