Updating 7-Zip closes the bug in the standalone archiver, but it does not automatically repair products that bundled the same XZ decoder. The issue is a heap overflow in how 7-Zip counts free space while unpacking a crafted XZ archive, so the unsafe write happens inside the process that opens the file.
7-Zip 26.02 fixes CVE-2026-14266. The catch is that downstream software embedding the decoder may still carry the same flaw until its own vendor ships a separate patch, so patch status has to be checked in both the user-installed app and any bundled components.