Loading vulnerability…
CVE-2026-14266 is a heap-based buffer overflow in 7-Zip versions earlier than 26.02 when processing XZ chunked data. The flaw is located in the XZ decoder's MixCoder_Code function, where output-buffer length handling fails to account correctly for bytes written during prior passes. A specially crafted XZ archive or compressed stream can consequently cause an out-of-bounds heap write. 7-Zip 26.02 corrects the available-space calculation and aborts processing on overflow conditions.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
Repository is a focused exploit-research project for CVE-2026-14266, a heap-based buffer overflow in 7-Zip's multi-threaded XZ decoder path. The repo contains one main exploit artifact, poc/poc-cve-2026-14266-rce.py, plus supporting documentation, a source diff showing the vulnerable/fixed code, and PowerShell tooling for Windows heap/debug analysis. Main exploit capability: the Python script generates malicious .xz archives whose declared unpackSize is smaller than the actual LZMA2 uncompressed copy-chunk output. This abuses the vulnerable MixCoder_Code SingleBuf/outBuf branch in C/XzDec.c, where destLen2 is not clamped against remaining outBuf capacity before being passed to the decoder. The result is a controlled heap write past outBuf. The script supports multiple payload modes including crash-only output, cyclic patterns for offset discovery, raw payload files, placeholder ROP content, and embedded Win64 calc.exe shellcode. Based on the repository text, confirmed behavior is reliable DoS and controlled overflow bytes; full end-to-end RCE is still under development. Repository structure: README.md provides the executive summary, root cause, exploitation notes, and file map. docs/01-crash-point-analysis.md documents the crash site and stack frames. docs/02-vulnerability-root-cause.md explains the vulnerable/fixed code path and why the bug is multi-thread-only. docs/03-rce-exploit-plan.md outlines heap-targeting ideas and debugger workflow. src-diff/XzDec.diff.txt contains the key 26.01 vs 26.02 patch delta. tools/04-heap-analyze.ps1 automates x64dbg MCP queries to inspect registers, modules, and heap state. tools/05-mini-debugger.ps1 is a custom PowerShell/C# Win32 debugger wrapper to capture crash context. tools/06-guard-dump.ps1 uses guard pages to catch the first overflow write and inspect adjacent LFH objects. Attack surface is file-based: a victim must extract a crafted .xz archive with vulnerable 7-Zip on Windows, in multi-threaded mode. The repo does not contain a remote delivery component; network references are only to a local debugger automation endpoint (127.0.0.1:3000/mcp). Overall, this is a real exploit-development repository with an operational PoC generator and auxiliary tooling for advancing from crash reproduction toward controlled heap corruption and possible code execution.
This repository is a small standalone proof-of-concept consisting of one Python script and a README. The main file, CVE-2026-14266.py, does not exploit a network service and contains no remote callback logic; instead, it programmatically builds a malformed .xz archive from scratch to trigger a vulnerability in 7-Zip's XZ decoder. The script implements helper routines for CRC32 calculation and variable-length integer encoding, then constructs LZMA2 copy chunks via craft_lzma2_copy_chunks() and wraps them in a syntactically valid XZ container via build_xz_file(). In main(), it sets a fixed unpack size of 262144 bytes and writes the resulting archive as poc-cve-2026-14266-crash.xz in the script directory. The exploit capability is limited to file generation for crash reproduction: it is intended to trigger a heap buffer overflow when a vulnerable 7-Zip instance decompresses the crafted archive. There is no embedded command execution, shell payload, persistence, or data exfiltration logic. Based on the code and README, this is a file-based denial-of-service/crash PoC rather than a weaponized RCE exploit. The README identifies the target as CVE-2026-14266 affecting 7-Zip's XZ decoder, fixed in version 26.02 or later, and notes testing on Windows 11 x64 with 7-Zip 26.01.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
73 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A vulnerability affecting the 7zip package on openSUSE 16.0. The supplied CVSS v3 vector rates it as a local flaw requiring user interaction but no privileges, with high confidentiality, integrity, and availability impact.
A heap-based buffer overflow vulnerability in 7-Zip that can allow remote arbitrary code execution via a crafted XZ file during XZ chunked data processing.
A heap-based buffer overflow in 7-Zip's handling of malformed XZ chunked data that may lead to arbitrary code execution in the current user's context.
Heap-based buffer overflow remote code execution vulnerability in 7-Zip's MixCoder_Code function when processing specially crafted XZ archives.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.