7-Zip 26.02 closes dangerous code-smuggling vulnerability

The discoverer of the vulnerability is ZDI. It was reported to 7-Zip developer Igor Pavlov on 5 June. He released a patch on 25 June with version 26.02. ZDI published its advisory on 15 July. The release notes for 7-Zip 26.02 do not name the vulnerability explicitly, but merely state that „einige Fehler und Sicherheitslücken behoben" were fixed.

According to ZDI, the vulnerability carries the identifier CVE-2026-14266 and was rated with a CVSS score of 7.0 – classified as "high". The NVD database lists the entry.

The previous version 26.01 from 27 April had already closed a dangerous vulnerability that could likewise be exploited simply by opening a specially crafted file. Security researchers advise users still running a 7-Zip version prior to 26 January to update immediately.

Timeline of discovery and patch

The new version 26.02 can be downloaded from the download area on 7-zip.org. This provides not only the security patch but also a cleaned-up version of the free archiver.

Chrome: Second update within a week

In parallel, the Chrome browser also received scheduled updates on Wednesday: „In der Nacht zum Mittwoch hatten Googles Entwickler hingegen 15 Lücken im Browser geschlossen". „Google aktualisiert Chrome eigentlich jeden Mittwoch." Two of these vulnerabilities were considered "critical risk". They were use-after-free leaks in the Ozone component.

In the previous week, Google's developers had closed a total of 27 vulnerabilities in Chrome. „Davon galten zwei als kritisch." There too, there were no indications of active exploitation of the fixed vulnerabilities in the wild.

Google released an unscheduled update for the Chrome web browser on Friday night. With this, the developers are now closing another seven security vulnerabilities in the web browser. Three of them are considered "critical". It is the second update this week following the scheduled Wednesday update.

The Chrome versions released on Wednesday carried the numbers 150.0.7871.124/.125 for macOS and Windows. The updated Chrome versions carry the numbers 150.0.7871.128/.129 for macOS and Windows.

The three critical vulnerabilities in the Friday update are unspecified use-after-free vulnerabilities in the components CameraCapture (CVE-2026-15899), GPU (CVE-2026-15900), and Network (CVE-2026-15901). „CVE-2026-15899, GPU (CVE-2026-15900) sowie Network (CVE-2026-15901)".

Notes on updating

It is not clear from the announcement why the update was made outside the regular schedule. Typically, Google notes actively exploited vulnerabilities in the release notes: „sofern die Lücken von Angreifern im Internet missbraucht werden, schreibt Google das üblicherweise auch in der Versionsankündigung. Das ist hier nicht der Fall."

Since the vulnerabilities affect the Chromium base, web browsers based on it are likely to deliver updates shortly. These include Microsoft's Edge. At the same time, Google also released the first 151 builds for Android and iOS.

To apply the Chrome update, users can open the version dialog. It is hidden in the browser menu under "Help" – "About Google Chrome". On Linux, the distribution's software management is normally used to update the web browser.

Security experts recommend updating both Chrome and 7-Zip promptly, as the disclosed vulnerabilities pose a significant risk for the execution of malicious code.