Actively exploited in the wild
7-Zip Mark of the Web Bypass Vulnerability
7-Zip - 7-Zip · Listed in the CISA KEV since 2025-02-06. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2025-0411
HighCVSS 7.0KEVSummary
7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of archived files. When extracting files from a crafted archive that bears the Mark-of-the-Web, 7-Zip does not propagate the Mark-of-the-Web to the extracted files. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user.
Risk Assessment
The risk includes potential arbitrary code execution on the user's computer, which could lead to system infection and data theft.
Recommendation
Update 7-Zip to the latest version that includes a fix for this vulnerability, and exercise caution when opening archives from untrusted sources.
Other vulnerabilities in 7-Zip
See all- CVE-2026-48112Medium
7-Zip versions 9.18 through 26.00 contain a heap out-of-bounds read vulnerability in the BSD SYMDEF parser. The ParseLibSymbols function reads data beyond the allocated memory area, potentially leading to leakage of uninitialized data.
- CVE-2026-48104Medium
7-Zip versions 9.18 through 26.00 contain a vulnerability in the SquashFS archive handler, involving an uninitialized heap read. This issue occurs when processing images with few inodes, potentially leading to memory information disclosure.
- CVE-2026-48095High
7-Zip versions 26.00 and prior contain a heap buffer overflow vulnerability caused by an under-allocation in the NTFS compressed stream buffer. Attackers may exploit this vulnerability to execute arbitrary code or cause application crashes.
- CVE-2026-48092Medium
7-Zip is a file archiver with a high compression ratio. Versions 9.34 through 26.00 contain a heap memory disclosure due to an integer overflow in the SquashFS ReadBlock function on 32-bit builds.
- CVE-2025-53816High
7-Zip is a file archiver with a high compression ratio. Versions of 7-Zip prior to 25.0.0 have an issue with writing zeroes outside the heap buffer in the RAR5 handler, which may lead to memory corruption and denial of service.
- CVE-2026-14266High
In 7-Zip, a heap-based buffer overflow vulnerability exists in XZ decompression that allows remote code execution. User interaction is required – the victim must visit a malicious page or open a malicious file. Crafted XZ-compressed data can trigger a heap-based buffer overflow.
- CVE-2026-58052Low
7-Zip for Windows up to version 26.01 fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive. Its guard that suppresses an archive-supplied Zone.Identifier stream matches the exact name 'Zone.Identifier' while a RAR5 STM record named ':Zone.Identifier:$DATA' is not matched and NTFS canonicalizes it to the same stream, overwriting the propagated Internet-zone marker with ZoneId=0. A second STM record named '::$DATA' overwrites the extracted file's default data stream, letting an attacker defeat SmartScreen/MotW warnings and spoof file content.
- CVE-2026-48101Medium
7-Zip, a file archiver, contains an uninitialized memory disclosure vulnerability in the UEFI capsule (.scap) parser in versions 9.21 through 26.00. The OpenCapsule function allocates a heap buffer without zero-initialization, which may lead to unauthorized data exposure.
Original NVD description (English source)
7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of archived files. When extracting files from a crafted archive that bears the Mark-of-the-Web, 7-Zip does not propagate the Mark-of-the-Web to the extracted files. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user. Was ZDI-CAN-25456.