7-Zip XZ Decompression Heap-based Buffer Overflow bundled with PRI7000
7-Zip 26.01 and older contains a heap-based buffer overflow in XZ decompression. A crafted XZ archive can cause arbitrary code execution in the current user's context. The vulnerable portable version of 7-Zip is bundled with Bosch Rexroth AG PRI7000. The component must be accessed directly on the customer PC; PRI7000 and its other components cannot exploit the vulnerability indirectly.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-14266US | high7.8 | Exploit | ||
7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installation… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (1)
- BehobenPRI7000
Update PRI7000 to version 1.11.17.3, 1.11.18.3, or 1.11.19.1 or newer, as applicable.
https://store.boschrexroth.com/de/de/pri7000-engineering-software
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan