CVE-2026-14266: Inside the 7-Zip Heap Overflow Hiding in XZ Archives Since 2021
A heap-based buffer overflow in 7-Zip’s XZ decoder, patched in version 26.02, let a crafted archive run code on extraction and had gone unnoticed for five years.
A heap-based buffer overflow in 7-Zip’s XZ decoder, patched in version 26.02, let a crafted archive run code on extraction and had gone unnoticed for five years.
An AI-driven threat actor called JADEPUFFER built ransomware that hunts AI model files specifically, entering through a known Langflow RCE and pivoting via an exposed Docker socket.