Skip to main

7-Zip XZ Decompression Heap-based Buffer Overflow bundled with PRI7000

BOSCH-SA-069646

Advisory Information

Summary

7-Zip 26.01 and older contains a heap-based Buffer Overflow vulnerability that can be triggered via a crafted XZ archive, allowing the attacker to execute arbitrary code in the current user's context.

The vulnerable component 7-Zip is bundled in its portable version with the Bosch Rexroth AG software PRI7000. An attacker can exploit the vulnerable component by accessing it directly on the customer PC. The PRI7000 and its other components cannot be used to exploit the vulnerability indirectly.

Affected Products

  • Bosch Rexroth AG PRI7000
    • CVE-2026-14266
      • Version(s): all < 1.11.17.3
    • CVE-2026-14266
      • Version(s): all < 1.11.18.3
    • CVE-2026-14266
      • Version(s): all < 1.11.19.1

Solution and Mitigations

Solution

Update to PRI7000 version 1.11.17.3, 1.11.18.3 or 1.11.19.1 or newer, if possible.

Vulnerability Details

CVE-2026-14266

CVE Description: 7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the processing of XZ chunked data. Crafted XZ-compressed data can trigger an overflow of a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30169.

Remarks

Security Update Information

With respect to Directive (EU) 2019/770 and Directive (EU) 2019/771 and their national transposition laws, please note:

It is your responsibility to download and/or install any security updates provided by us, for example to maintain product or data security. If you fail to install a security update provided to you within a reasonable period of time, we will not be liable for any product defect solely due to the absence of such security update.

Alternatively, we are entitled to directly download and/or install security updates regardless of your settings. In these cases, we will provide you with the relevant information, e.g. in this security advisory.

CVSS Scoring

Vulnerability classification has been performed using the CVSS v3.0 scoring system. The CVSS environmental score is specific to each customer's environment and should be defined by the customer to attain a final scoring.

Additional Resources

Revision History

  • Oct 12, 2026: Initial Publication

Appendix

CPEs

cpe:2.3:a:boschrexroth:pri7000:*:*:*:*:*:*:*:*, up to (excluding): 1.11.17.3

cpe:2.3:a:boschrexroth:pri7000:*:*:*:*:*:*:*:*, up to (excluding): 1.11.18.3

cpe:2.3:a:boschrexroth:pri7000:*:*:*:*:*:*:*:*, up to (excluding): 1.11.19.1