A newly discovered flaw in the 7‑Zip file extraction tool allows malicious XZ archives to execute arbitrary code during extraction. The issue was brought to public attention by The Hacker News.
Tracked as CVE-2026-14266, the vulnerability carries a CVSS score of 7.0. Exploitation requires a user to open a specially crafted XZ archive, after which the flawed extraction routine can run attacker‑supplied code. The vulnerability does not affect other archive formats handled by the tool.
A patch was issued in version 26.02 of 7‑Zip, which became available on 25 June 2026. Users are advised to upgrade to this release or a later build to close the gap. The advisory detailing the fix was published by Security Online.
As of now there have been no confirmed detections of the flaw being used in the wild and no threat actor has been linked to the issue. Nevertheless, the requirement for only a single user action makes the bug attractive for phishing or social‑engineering campaigns.
Defenders should ensure all workstations are running 7‑Zip 26.02 or later, verifying the version through standard inventory or patch‑management tools. It is also wise to remind staff not to open archives from unknown or unverified sources, treating them as potentially hostile. Application whitelisting can help prevent any unexpected executables from running after extraction.
Additionally, administrators can disable automatic extraction features in file‑explorers or email clients, forcing a manual step that may give users a chance to inspect the file. Monitoring endpoint logs for spawning of processes from temporary directories after an archive is opened can provide early detection of abuse.