Skip to content
OpenAdvisories
High · 7.0 Public exploit CVE-2026-14266 EUVD-2026-50420GHSA-836v-xv29-x32v

7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability

Published Jul 29, 2026 · Updated Jul 30, 2026 · Assigned by zdi

Vendor: 7-Zip Product: 7-Zip Package: 7zip Package: 7zip Package: p7zip Package: p7zip Ecosystem: Debian Ecosystem: Ubuntu

Description

7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the processing of XZ chunked data. Crafted XZ-compressed data can trigger an overflow of a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30169.

Affected products

VendorProductAffectedFixed
7-Zip 7-Zip 26.01 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 7zip 26.02+dfsg-1 —
Debian 13 7zip No fix yet —
Debian 13 p7zip 16.02+transitional.1 —
Debian 12 7zip 22.01+really26.02+dfsg-0+deb12u1 —
Debian 12 p7zip 16.02+really26.02+dfsg-0+deb12u1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 7zip No fix yet —
Ubuntu 26.04 LTS 7zip No fix yet —
Ubuntu 22.04 LTS p7zip No fix yet —
Ubuntu 20.04 LTS p7zip No fix yet —
Ubuntu 18.04 LTS p7zip No fix yet —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS p7zip No fix yet —
Ubuntu 14.04 LTS p7zip No fix yet —
Ubuntu Pro 24.04 LTS 7zip No fix yet —
Ubuntu Pro 22.04 LTS 7zip No fix yet —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 7zip 26.02-150400.9.9.1 SUSE-SU-2026:3869-1
SLES 15 SP6 7zip 26.02-150400.9.9.1 SUSE-SU-2026:3869-1
SLES 15 SP5 7zip 26.02-150400.9.9.1 SUSE-SU-2026:3869-1
SLES 15 SP4 7zip 26.02-150400.9.9.1 SUSE-SU-2026:3869-1
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 7zip 26.02-160000.1.1 SUSE-SU-2026:23317-1
SLES for SAP 15 SP6 7zip 26.02-150400.9.9.1 SUSE-SU-2026:3869-1
SLES for SAP 15 SP5 7zip 26.02-150400.9.9.1 SUSE-SU-2026:3869-1
SLES for SAP 15 SP4 7zip 26.02-150400.9.9.1 SUSE-SU-2026:3869-1
SLES 16.0 7zip 26.02-160000.1.1 SUSE-SU-2026:23317-1
SLE HPC 15 SP5 7zip 26.02-150400.9.9.1 SUSE-SU-2026:3869-1
SLE HPC 15 SP4 7zip 26.02-150400.9.9.1 SUSE-SU-2026:3869-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed 7zip 26.02-1.1 openSUSE-SU-2026:11319-1
openSUSE Leap 16.0 7zip 26.02-160000.1.1 openSUSE-SU-2026:21641-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 7zip +3 26.02-17.amzn2023.0.1 ALAS2023-2026-2037

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 3 repositories

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 6

References