Astra Linux – Vulnerability in p7zip

The NtfsHandler.cpp NTFS handler in 7-Zip before version 24.01 for 7zz contains a heap-based buffer overflow vulnerability. This vulnerability allows an attacker to overwrite two bytes at multiple offsets beyond the allocated buffer size: buffer+512i-2, where i ranges from 9, 10, 11, etc...

Astra Linux – Vulnerability in p7zip

7-Zip before version 25.01 does not always handle symbolic links correctly during extraction...

Astra Linux – Vulnerability in p7zip-rar

7-Zip is a file archiver with a high compression ratio. Writing zeros outside the heap buffer in the RAR5 handler may lead to memory corruption and denial of service in versions of 7-Zip prior to version 25.0.0. Version 25.0.0 contains a fix for this issue...

JLSEC-2026-1169 7-Zip for Windows fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive

7-Zip for Windows through 26.01 fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive, because its guard that suppresses an archive-supplied Zone.Identifier stream matches the exact name 'Zone.Identifier' while a RAR5 STM record named ':Zone.Identifier:$DATA' is not matched...

[SECURITY] [DLA 4719-1] p7zip security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4719-1 [email protected] https://www.debian.org/lts/security/ Sylvain Beucler August 05, 2026 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 4718-1] 7zip security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4718-1 [email protected] https://www.debian.org/lts/security/ Sylvain Beucler August 05, 2026 https://wiki.debian.org/LTS -...

Debian dla-4719 : p7zip - security update

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4719 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4719-1 [email protected]...

Important: 7zip

Issue Overview: NOTE: Since p7zip/16.02+transitional.1 src:p7zip is only an empty source package NOTE: depending on 7zip. Mark this version as fixed version. NOTE: https://www.zerodayinitiative.com/advisories/ZDI-26-444/ DEBIANBUG: 1142293 CVE-2026-14266 Affected Packages: 7zip Issue Correction:...

Amazon Linux 2023 : 7zip, 7zip-reduced, 7zip-standalone (ALAS2023-2026-2037)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2037 advisory. NOTE: Since p7zip/16.02+transitional.1 src:p7zip is only an empty source packageNOTE: depending on 7zip. Mark this version as fixed version.NOTE:...

SUSE CVE-2026-6340

Mattermost versions 11.5.x = 11.5.1, 10.11.x = 10.11.13, 11.4.x = 11.4.3 fail to validate 7zip archive structure before processing which allows an authenticated attacker to cause server memory exhaustion and denial of service via uploading a specially crafted 7zip file with excessive folder...

SUSE CVE-2026-14266

7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page...

CVE-2026-14266

A flaw was found in 7-Zip. This vulnerability allows a remote attacker to execute arbitrary code on affected installations. Exploitation requires user interaction, such as opening a specially crafted malicious file or visiting a malicious web page. The flaw occurs during the processing of...

CVE-2026-14266

7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page...

EUVD-2026-50420

7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page...

CVE-2026-14266

Summary: CVE-2026-14266 affects 7-Zip 26.01 and earlier in the multi-threaded XZ decoder path. A heap-based buffer overflow in MixCoder_Code() occurs when processing crafted XZ data, allowing potential remote code execution and denial of service. Root cause: missing boundary clamp on destLen2 in ...

CVE-2026-14266

7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page...

CVE-2026-14266 7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability

7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page...

CVE-2026-14266 7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability

7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page...

Exploit for CVE-2026-14266

CVE-2026-14266 — 7-Zip XZ Decoder Heap Buffer Overflow Cr...

The vulnerability of the MixCoder_Code() function in the XZ Decoder component of the 7-Zip archive decoder allows a hacker to execute arbitrary code.

The vulnerability of the MixCoderCode function in the XZ Decoder component of the 7-Zip archive processor is related to buffer overflow in dynamic memory. Exploiting this vulnerability could allow an attacker to execute arbitrary code...