Exploit for CVE-2026-14266

Name: Exploit for CVE-2026-14266
Rating: 5 (3 reviews)
2026-07-22 | CVSS 0.0
## https://sploitus.com/exploit?id=6F45F0C2-8BEF-5F3E-A5F7-29FA06C61494
# CVE-2026-14266: 7-Zip XZ Heap Buffer Overflow PoC Generator

Proof of Concept generator for reproducing the XZ heap buffer overflow vulnerability in 7-Zip.

The script creates a specially crafted `.xz` archive designed to reproduce the crash condition in the vulnerable multi-threaded XZ decompression path.

---

## Vulnerability Information

- **CVE**: CVE-2026-14266
- **Type**: Heap Buffer Overflow
- **Affected Software**: 7-Zip 26.01
- **Component**: XZ Decoder
- **Trigger**: Crafted XZ archive processed through the vulnerable multi-threaded decoding path

---

## Features

- Generates a valid `.xz` archive from scratch
- Reproduces the crash condition on vulnerable versions of 7-Zip
- No external archive generation tools required

---

## Usage

```bash
python3 CVE-2026-14266.py
```


### Output

```
poc-cve-2026-14266-crash.xz
```

---

## Tested Environment

- Windows 11 x64
- 7-Zip 26.01 [https://github.com/ip7z/7zip/archive/refs/tags/26.01.zip]

---

## References

- https://socradar.io/blog/7-zip-cve-2026-14266-rce/
- https://www.penligent.ai/hackinglabs/cve-2026-14266/
- https://mallory.ai/vulnerabilities/CVE-2026-14266