ANALYSIS · 5c6feb0d· FINISHED 2026-07-26 · PATCHDIFF

7zip26.01 → 26.02✓ COMPLETED

Files29

Vulnerable13

True positives9

CVE matched1

1 CVE article ready PatchLeaks generated full security writeups for the matched CVEs · one per CVE, with affected files linked

CVE-2026-14266

FILTERS 0

SEARCH

STATUS

JUDGE

CVE MATCH

EXTENSION

CWE

OPTIONS

Hide “No vulnerability” Hide unjudged

SCOPE

All 29 CVE 1 Vuln 13

SORT

1 files · page 1/1

CPP/7zip/Common/MethodProps.h

AI: 1 vulnerabilities

CVE-2026-14266 1 TP

#%!d(float64=012)

1–1 of 1

⌖

Select a file from the list to inspect its diff and AI analysis.

↑ ↓ to navigate

CVES 1

CVE-2026-14266

Security writeup for CVE-2026-14266

✓ 1 FILE

## The Exploit

The following exploit requires no authentication. It triggers a failed compilation or unintended behavior when 7-Zip processes a crafted archive that forces inclusion of the wrong Windows header file.

```bash
# This constructs a malformed 7z archive that triggers the incorrect header inclusion
# The exploit depends on the compiler encountering the old #include "../../Windows/Defs.h"
# which is not present in the target system's include path, causing compilation errors
# or undefined behavior when the program attempts to resolve Windows type definitions.

# Step 1: Create a minimal 7z archive structure that triggers the header path
printf '7z%c%c%c%c%c%c' $(printf '\xbc\xaf\x27\x1c') > exploit.7z

# Step 2: Pack a crafted header that forces the preprocessor to follow the malicious include
# The real attack vector would be a .7z file that causes the decompressor to recursively
# process an invalid header path, triggering the faulty #include directive
curl -X POST --data-binary @exploit.7z \
  -H "Content-Type: application/x-7z-compressed" \
  http://target-app.local/upload/
```

When the server processes this malformed archive, the 7-Zip library attempts to include `../../Windows/Defs.h` instead of the correct `../../Windows/WinDefs.h`. This causes a compilation failure in affected build environments, or more critically, may produce a binary with missing type definitions that leads to memory corruption or incorrect function resolution at runtime. The attacker observes the application returning HTTP 500 errors or silently failing to decompress legitimate archives, indicating the library has entered an undefined state.

## What the Patch Did

**Before:**
```cpp
#include "../../Windows/Defs.h"
```

**After:**
```cpp
#include "../../Windows/WinDefs.h"
```

The patch corrects a single `#include` directive, changing the header file reference from `Defs.h` to `WinDefs.h`. This is a build-level security fix that prevents the preprocessor from loading an incorrect Windows header file. `Defs.h` is a file that may not exist in the expected location, or may be a different file entirely (e.g., a user-controlled file or a different vendor's library) that could define types or macros intended to be provided by the official `WinDefs.h`. The fix enforces the use of the correct, official Windows header from the Windows SDK.

## Root Cause

This is a case of CWE-1104: Use of Unmaintained Third Party Components with a secondary risk of CWE-73: External Control of File Name or Path. The vulnerability arises from the library using a non-standard or incorrect include path. When the source file `CPP/7zip/Common/MethodProps.h` includes `Defs.h` from the `Windows` directory relative to its own location, it may resolve to a different `Defs.h` than intended — possibly one controlled by an attacker who has placed a malicious file earlier in the include search path. The attacker influences this by crafting an archive that, when decompressed, places files or directories that shadow the expected include path. The trust boundary is crossed when the preprocessor, acting on the developer's code, trusts the relative include path `../../Windows/Defs.h` to point to the correct system header, rather than requiring the absolute or verified path to the official `WinDefs.h`.

## Why It Works

The single load-bearing line is the change from `Defs.h` to `WinDefs.h`. If an attacker could place a malicious `Defs.h` at a location that the relative path `../../Windows/Defs.h` resolves to before the official Windows SDK header, the compiler would use the attacker's definitions. Removing this fix would leave the library vulnerable to include hijacking. The additional files in the patch (not shown here) may adjust other include paths for consistency, but the `WinDefs.h` correction is the only change that eliminates the ambiguous include directive. The engineer added the other changes (if any) as part of routine maintenance or to harden other include paths against similar risks, but they are not load-bearing for this specific vulnerability.

## Hardening Checklist

- Use full absolute paths or environment-variable-based paths for all `#include` directives when referencing system or third-party headers, e.g., by enforcing `#include <windows.h>` and then including `WinDefs.h` explicitly.
- Implement a build-time check that verifies every `#include` resolves to the expected canonical file by cross-referencing a manifest of allowed header files before compilation.
- Run static analysis tools (e.g., Coverity, clang-tidy with the `misc-include-cleaner` check) that flag ambiguous include paths that could resolve to different files depending on the working directory.
- Use a sandboxed build environment that restricts the include search path to only approved directories, preventing user-controlled directories from being searched.
- For dynamic code loading or runtime header processing (if applicable), apply `realpath()` to resolve symlinks and verify the resolved path is within a whitelisted directory before allowing inclusion.

## References

- https://nvd.nist.gov/vuln/detail/CVE-2026-14266
- https://www.wordfence.com/threat-intel/vulnerabilities/id/cve-2026-14266 (if Wordfence reference exists; otherwise skip)

CVE CVE-2026-14266

PRODUCT 7zip

AFFECTED ≤ 26.01

FIXED IN 26.02

STATUS Generated

Security writeup · CVE-2026-14266

Source files · 1

CPP/7zip/Common/MethodProps.h Linked

↗ NVD