Vendor

7-Zip

Vulnerabilities in Igor Pavlov's 7-Zip, the open-source archive utility bundled or installed on tens of millions of Windows endpoints. 7-Zip ships without an auto-update mechanism, so parser bugs — heap overflows in Zstd, XZ, or LZMA decompression, path-traversal in extraction — tend to sit on user machines long after the fix is out.

1 CVEs1 articlesRSS

CVEs

CVE-2025-0411

[ HIGH ]CVSS 7.0EPSS 67.1%kev

7-Zip Mark of the Web Bypass Vulnerability

7-Zip contains a protection mechanism failure vulnerability that allows remote attackers to bypass the Mark-of-the-Web security feature to execute arbitrary code in the context of the current user.

7-Zip / 7-ZipFeb 6, 2025

Articles

~/articles/2026-07-18-7-zip-26-02-xz-heap-overflow-rce-zdi-26-444

7 zip

7-Zip 26.02 patches XZ heap overflow, no auto-update

7-Zip 26.02 fixes a heap-based buffer overflow in XZ decompression (ZDI-26-444) — RCE if a user opens a crafted archive, and there is no automatic update.

Jul 18read →