importantSYS.SOURCE: The Hacker News• 2026-07-20T14:40:56+05:30

7-Zip XZ Archive Code Execution Vulnerability CVE-2026-14266

#software security #code execution #vulnerability

A heap-based buffer overflow in 7-Zip's XZ archive processing allows code execution during extraction, mitigated in version 26.02 with updated buffer length handling. The vulnerability requires user interaction and has a CVSS score of 7.0.

Opening a crafted XZ archive in 7-Zip could let an attacker run code on the machine. The flaw, CVE-2026-14266, is a heap-based buffer overflow in how the archiver processes XZ chunked data, and Trend Micro's Zero Day Initiative (ZDI) detailed it on July 15. A fix shipped on June 25 in 7-Zip 26.02.

The overflow lets an attacker "execute code in the context of the current process," per the

Read original article

*** END OF TRANSMISSION ***

> NATURAL SECURES $30M TO DEVELOP AI AGENT PAYMENT INFRASTRUCTURE COMPETING WITH STRIPE > NATIV: LOCAL EXECUTION OF FRONTIER AI MODELS ON APPLE SILICON MACS > EMPIRICAL ANALYSIS OF CONTEXTUAL AND LAYERED ENFORCEMENT REQUIREMENTS FOR AI AGENT POLICIES > IDENTIFYING ROOT CAUSES OF SOFTWARE DELIVERY INEFFICIENCIES > JUDGE TEMPORARILY HALTS $110B PARAMOUNT-WARNER BROS MERGER AMID ANTITRUST CONCERNS > ADDRESSING NON-EXISTENT ONLINE CONTENT: A CALL FOR SOURCE VERIFICATION > HYPRLAND 0.55 INTRODUCES LUA-BASED CONFIGURATION SYSTEM > AI-ASSISTED PHISHING TOOLKIT EXPLOITING WEBDAV VULNERABILITY EXPOSED IN OPEN SERVER > KIMI WORK: AI DESKTOP AGENT FOR KNOWLEDGE WORKERS > JELLY UI: A WEB COMPONENTS LIBRARY FOR TACTILE INTERFACES WITH SOFT-BODY PHYSICS> NATURAL SECURES $30M TO DEVELOP AI AGENT PAYMENT INFRASTRUCTURE COMPETING WITH STRIPE > NATIV: LOCAL EXECUTION OF FRONTIER AI MODELS ON APPLE SILICON MACS > EMPIRICAL ANALYSIS OF CONTEXTUAL AND LAYERED ENFORCEMENT REQUIREMENTS FOR AI AGENT POLICIES > IDENTIFYING ROOT CAUSES OF SOFTWARE DELIVERY INEFFICIENCIES > JUDGE TEMPORARILY HALTS $110B PARAMOUNT-WARNER BROS MERGER AMID ANTITRUST CONCERNS > ADDRESSING NON-EXISTENT ONLINE CONTENT: A CALL FOR SOURCE VERIFICATION > HYPRLAND 0.55 INTRODUCES LUA-BASED CONFIGURATION SYSTEM > AI-ASSISTED PHISHING TOOLKIT EXPLOITING WEBDAV VULNERABILITY EXPOSED IN OPEN SERVER > KIMI WORK: AI DESKTOP AGENT FOR KNOWLEDGE WORKERS > JELLY UI: A WEB COMPONENTS LIBRARY FOR TACTILE INTERFACES WITH SOFT-BODY PHYSICS