7‑Zip XZ Decoder Buffer Overflow (CVE‑2026‑14266) Enables Code Execution
ZDI’s advisory (CVE‑2026‑14266) reveals a heap‑based buffer overflow in 7‑Zip’s XZ chunked data processing that can execute arbitrary code when a crafted archive is opened. The flaw affects all versions prior to 26.02, which ships the fix. Users should upgrade immediately to mitigate remote‑code execution risk.