7-Zip XZ Decompression MixCoder_Code Heap-Based Buffer Overflow

# Check-CVE-2026-14266.ps1
# Detects 7-Zip installations vulnerable to CVE-2026-14266 (< 26.02)
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit:   1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN

$ErrorActionPreference = 'SilentlyContinue'
$PatchedMajor = 26
$PatchedMinor = 2
$found = $false

# Build candidate paths from registry + well-known locations
$candidates = @()
$regKeys = @(
    'HKLM:\SOFTWARE\7-Zip',
    'HKLM:\SOFTWARE\WOW6432Node\7-Zip',
    'HKCU:\SOFTWARE\7-Zip'
)
foreach ($rk in $regKeys) {
    if (Test-Path $rk) {
        $p = (Get-ItemProperty -Path $rk -Name 'Path' -ErrorAction SilentlyContinue).Path
        if ($p) { $candidates += Join-Path $p '7z.exe' }
    }
}
$candidates += "$env:ProgramFiles\7-Zip\7z.exe"
$candidates += "${env:ProgramFiles(x86)}\7-Zip\7z.exe"
$candidates = $candidates | Select-Object -Unique

foreach ($exe in $candidates) {
    if (Test-Path $exe) {
        $found = $true
        # Parse version from 7z.exe console banner, e.g. "7-Zip 26.02 (x64) : ..."
        $banner = & $exe 2>&1 | Select-Object -First 3 | Out-String
        if ($banner -match '7-Zip\s+(\d+)\.(\d+)') {
            $major = [int]$Matches[1]
            $minor = [int]$Matches[2]
            if (($major -gt $PatchedMajor) -or (($major -eq $PatchedMajor) -and ($minor -ge $PatchedMinor))) {
                Write-Output "PATCHED - 7-Zip $major.$($minor.ToString('D2')) at $exe (>= 26.02)"
                exit 0
            } else {
                Write-Output "VULNERABLE - 7-Zip $major.$($minor.ToString('D2')) at $exe (< 26.02) - CVE-2026-14266"
                exit 1
            }
        } else {
            Write-Output "UNKNOWN - Found $exe but could not parse version from banner output"
            exit 2
        }
    }
}

if (-not $found) {
    Write-Output "UNKNOWN - 7-Zip not found in standard locations or registry"
    exit 2
}