CVE-2026-14266highCWE-122

CVE-2026-14266: falha de alta gravidade em 7-Zip

7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar 7-Zip+ Monitorar p7zip

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

41Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendcvss 7epss 0.7%
da publicação à armano mesmo dia
Publicada no NVD29 de jul.
1ª PoC17 de jul.
7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of XZ chunked data. Crafted XZ-compressed data can trigger an overflow of a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30169.
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
7-Zip · 7-Zip
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — 7-Zip

No mesmo produto, das mais perigosas para as menos.

CVE-2025-0411HIGH7-Zip Mark-of-the-Web Bypass VulnerabilityEPSS 47.6%KEVCVE-2025-11001HIGH7-Zip ZIP File Parsing Directory Traversal Remote Code Execution VulnerabilityEPSS 27.4%CVE-2024-11477HIGH7-Zip Zstandard Decompression Integer Underflow Remote Code Execution VulnerabilityEPSS 22.4%CVE-2023-40481HIGH7-Zip SquashFS File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 13.8%CVE-2024-11612MEDIUM7-Zip CopyCoder Infinite Loop Denial-of-Service VulnerabilityEPSS 1.9%CVE-2025-55188LOWCVE-2025-55188EPSS 1.0%