Loading vulnerability…
CVE-2026-14266 is a heap-based buffer overflow in 7-Zip's XZ chunked-data decompression, specifically the MixCoder_Code function. The decoder incorrectly uses the full output-buffer length on successive passes rather than the remaining space after previous writes, allowing crafted XZ-compressed data to cause an out-of-bounds write. Successful exploitation requires user interaction and can execute arbitrary code in the context of the current process. The issue is fixed in 7-Zip 26.02; earlier builds should be treated as affected, although the complete historically exploitable version range has not been established. Vulnerable portable components are also bundled with Bosch Rexroth PRI7000.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
Repository is a focused exploit-research project for CVE-2026-14266, a heap-based buffer overflow in 7-Zip's multi-threaded XZ decoder path. The repo contains one main exploit artifact, poc/poc-cve-2026-14266-rce.py, plus supporting documentation, a source diff showing the vulnerable/fixed code, and PowerShell tooling for Windows heap/debug analysis. Main exploit capability: the Python script generates malicious .xz archives whose declared unpackSize is smaller than the actual LZMA2 uncompressed copy-chunk output. This abuses the vulnerable MixCoder_Code SingleBuf/outBuf branch in C/XzDec.c, where destLen2 is not clamped against remaining outBuf capacity before being passed to the decoder. The result is a controlled heap write past outBuf. The script supports multiple payload modes including crash-only output, cyclic patterns for offset discovery, raw payload files, placeholder ROP content, and embedded Win64 calc.exe shellcode. Based on the repository text, confirmed behavior is reliable DoS and controlled overflow bytes; full end-to-end RCE is still under development. Repository structure: README.md provides the executive summary, root cause, exploitation notes, and file map. docs/01-crash-point-analysis.md documents the crash site and stack frames. docs/02-vulnerability-root-cause.md explains the vulnerable/fixed code path and why the bug is multi-thread-only. docs/03-rce-exploit-plan.md outlines heap-targeting ideas and debugger workflow. src-diff/XzDec.diff.txt contains the key 26.01 vs 26.02 patch delta. tools/04-heap-analyze.ps1 automates x64dbg MCP queries to inspect registers, modules, and heap state. tools/05-mini-debugger.ps1 is a custom PowerShell/C# Win32 debugger wrapper to capture crash context. tools/06-guard-dump.ps1 uses guard pages to catch the first overflow write and inspect adjacent LFH objects. Attack surface is file-based: a victim must extract a crafted .xz archive with vulnerable 7-Zip on Windows, in multi-threaded mode. The repo does not contain a remote delivery component; network references are only to a local debugger automation endpoint (127.0.0.1:3000/mcp). Overall, this is a real exploit-development repository with an operational PoC generator and auxiliary tooling for advancing from crash reproduction toward controlled heap corruption and possible code execution.
This repository is a small standalone proof-of-concept consisting of one Python script and a README. The main file, CVE-2026-14266.py, does not exploit a network service and contains no remote callback logic; instead, it programmatically builds a malformed .xz archive from scratch to trigger a vulnerability in 7-Zip's XZ decoder. The script implements helper routines for CRC32 calculation and variable-length integer encoding, then constructs LZMA2 copy chunks via craft_lzma2_copy_chunks() and wraps them in a syntactically valid XZ container via build_xz_file(). In main(), it sets a fixed unpack size of 262144 bytes and writes the resulting archive as poc-cve-2026-14266-crash.xz in the script directory. The exploit capability is limited to file generation for crash reproduction: it is intended to trigger a heap buffer overflow when a vulnerable 7-Zip instance decompresses the crafted archive. There is no embedded command execution, shell payload, persistence, or data exfiltration logic. Based on the code and README, this is a file-based denial-of-service/crash PoC rather than a weaponized RCE exploit. The README identifies the target as CVE-2026-14266 affecting 7-Zip's XZ decoder, fixed in version 26.02 or later, and notes testing on Windows 11 x64 with 7-Zip 26.01.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
77 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A heap-based buffer overflow in XZ chunked-data processing affects 7-Zip versions before 26.02. An attacker can execute arbitrary code in the current process's context by convincing a user to visit a malicious page or open a malicious file. The reported CVSS v3 score is 7.8 (High). Nessus detects affected installations using the application's self-reported version rather than testing exploitation.
A heap-based buffer overflow in 7-Zip's processing of XZ chunked data allows arbitrary code execution in the current process. Exploitation requires the victim to visit a malicious page or open a malicious file. The content reports a CVSS v3 base score of 7.8 and available exploits. The prescribed fix is updating the 7zip library and related packages to version 22.01+really26.02+dfsg-0+deb12u1 or later.
A vulnerability affecting the 7zip package on openSUSE 16.0. The supplied CVSS v3 vector rates it as a local flaw requiring user interaction but no privileges, with high confidentiality, integrity, and availability impact.
A heap-based buffer overflow vulnerability in 7-Zip that can allow remote arbitrary code execution via a crafted XZ file during XZ chunked data processing.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.