Critical Heap Buffer Overflow in 7‑Zip (CVE‑2026‑14266) Enables Code Execution via Crafted XZ Archives
What It Is — A heap‑based buffer overflow was discovered in the XZ extraction routine of 7‑Zip versions ≤ 26.01. When a maliciously‑crafted XZ archive is opened, the overflow allows an attacker to execute arbitrary code in the context of the 7‑Zip process.
Exploitability — Proof‑of‑concept code has been released by Trend Micro’s Zero Day Initiative (ZDI). No public exploits are known in the wild yet, but the vulnerability is rated high (CVSS ≈ 9.0) and can be triggered simply by opening a malicious archive.
Affected Products — 7‑Zip 26.01 and earlier on Windows, macOS, and Linux. The vendor issued a patch in 7‑Zip 26.02 on June 25, 2026.
Why It Matters for Compliance & Audit Readiness
- Vulnerability Management (SOC 2 CC6.1/CC6.2): Unpatched software violates the requirement to remediate identified security weaknesses in a timely manner.
- Change & Configuration Management (CC6.3): Failure to enforce a controlled patch‑deployment process can be cited as a control gap during audits.
- Evidence of Due Diligence: Continuous monitoring of software versions and automated proof of patch status are now expected by enterprise buyers.
Recommended Actions
- Verify that all endpoints run 7‑Zip 26.02 or later; inventory any legacy versions.
- Deploy a centralized patch‑management or endpoint‑protection solution that captures version evidence for SOC 2 audits.
- Map this vulnerability to the SOC 2 “Vulnerability Management” control and record remediation dates in your compliance dashboard.
- Enable logging of archive extraction events to detect attempted exploitation.
Source: The Hacker News – New 7‑Zip Vulnerability Could Let Crafted XZ Archives Run Code During Extraction