7-Zip XZ Decompression Heap-based Buffer Overflow bundled with PRI7000
7-Zip 26.01 and older contains a heap-based buffer overflow in XZ decompression. A crafted XZ archive can cause arbitrary code execution in the current user's context. The vulnerable portable version of 7-Zip is bundled with Bosch Rexroth AG PRI7000. The component must be accessed directly on the customer PC; PRI7000 and its other components cannot exploit the vulnerability indirectly.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-14266US | high7.8 | Exploit | ||
7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installation… | ||||
references
External citations — patches, advisories, analysis.
remediations (1)
- FixedPRI7000
Update PRI7000 to version 1.11.17.3, 1.11.18.3, or 1.11.19.1 or newer, as applicable.
https://store.boschrexroth.com/de/de/pri7000-engineering-software
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan