Vulnerabilities

TI-2026-12078 CVE-2026-14266 · GHSA-836v-xv29-x32v

Heap-based buffer overflow in 7-Zip

LOW 37

7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00742 Published 2026-07-29 No fix listed CWE-122

TI-2026-41807 CVE-2026-58052 · GHSA-fx33-p83c-vpr5

7-Zip - Mark-of-the-Web Bypass via RAR5 Alternate Data Stream Name Collision

MEDIUM 55

7-Zip for Windows through 26.01 fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive, because its guard that suppresses an archive-supplied Zone.Identifier stream matches the exact name 'Zone.Iden…

CVSS 4.0MEDIUM 4.8 Local No auth User interaction EPSS 0.00171 Published 2026-06-28 No fix listed CWE-693

TI-2026-35552 CVE-2026-48112

GHSL-2026-122 7-Zip Ar SYMDEF OOB Read

LOW 28

7-Zip is a file archiver with a high compression ratio.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00267 Published 2026-06-05 Fixed in 26.01 CWE-125

TI-2026-35551 CVE-2026-48111

GHSL-2026-121 7-Zip UEFI DEPEX OOB Read

MEDIUM 64

7-Zip is a file archiver with a high compression ratio.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.02161 Published 2026-06-05 Fixed in 26.01 CWE-125

TI-2026-35544 CVE-2026-48104

GHSL-2026-120: 7-Zip SquashFS BlockToNode uninitialized heap read

MEDIUM 53

7-Zip is a file archiver with a high compression ratio.

CVSS 3.1MEDIUM 4.2 Network No auth User interaction EPSS 0.00179 Published 2026-06-05 Fixed in 26.01 CWE-125

TI-2026-35543 CVE-2026-48103

GHSL-2026-119 7-Zip WIM SecurityId OOB read

MEDIUM 64

7-Zip is a file archiver with a high compression ratio.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.02161 Published 2026-06-05 Fixed in 26.01 CWE-125

TI-2026-35542 CVE-2026-48102

GHSL-2026-118: 7-Zip UDF Field OOB Read

MEDIUM 53

7-Zip is a file archiver with a high compression ratio.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00189 Published 2026-06-05 Fixed in 26.01 CWE-125

TI-2026-35541 CVE-2026-48101

GHSL-2026-117: 7-Zip UEFI Capsule uninitialized heap memory disclosure

LOW 29

7-Zip is a file archiver with a high compression ratio.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00277 Published 2026-06-05 Fixed in 26.01 CWE-908

TI-2026-35535 CVE-2026-48095

GHSL-2026-140_7-Zip: 7-Zip has a heap buffer overflow via NTFS compressed stream buffer under-allocation

HIGH 73

7-Zip is a file archiver with a high compression ratio.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01116 Published 2026-06-05 No fix listed CWE-190

TI-2026-35532 CVE-2026-48092

7-Zip SquashFS Fragment Offset Overflow (GHSL-2026-116)

HIGH 68

7-Zip is a file archiver with a high compression ratio.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.02742 Published 2026-06-05 Fixed in 26.01 CWE-125

TI-2025-10073 CVE-2025-11002 · GHSA-6hqx-f664-v9xx

Path traversal in 7-Zip

LOW 37

7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00533 Published 2026-01-23 No fix listed CWE-22

TI-2025-10072 CVE-2025-11001 · GHSA-h6cw-8q9x-9gj9

Path traversal in 7-Zip

MEDIUM 58

7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.27387 Published 2025-11-19 No fix listed CWE-22

TI-2025-34865 CVE-2025-55188 · GHSA-58pw-r2v4-pwjv

7-Zip before 25.01 does not always properly handle symbolic links during extraction.

LOW 19

7-Zip before 25.01 does not always properly handle symbolic links during extraction.

CVSS 3.1LOW 3.6 Local No auth User interaction EPSS 0.00999 Published 2025-08-08 Fixed in 25.01 CWE-59

TI-2025-33709 CVE-2025-53817

GHSL-2025-059 - 7-Zip - Null pointer array write attempt in NArchive::NCom::CHandler::GetStream

LOW 26

7-Zip is a file archiver with a high compression ratio.

CVSS 4.0MEDIUM 5.5 Local No auth No interaction EPSS 0.00709 Published 2025-07-17 Fixed in 25.0.0 CWE-476

TI-2025-33708 CVE-2025-53816

GHSL-2025-058 - 7-Zip Multi-byte write heap buffer overflow in NCompress::NRar5::CDecoder

LOW 26

7-Zip is a file archiver with a high compression ratio.

CVSS 4.0MEDIUM 5.5 Local No auth No interaction EPSS 0.00733 Published 2025-07-17 Fixed in 25.0.0 CWE-122

TI-2022-23320 CVE-2022-47112 · GHSA-8j5h-cxpp-7g62

Improper check for unusual conditions in 7-Zip

MEDIUM 49

7-Zip 22.01 does not report an error for certain invalid xz files, involving stream flags and reserved bits.

CVSS 3.1LOW 3.3 Local No auth User interaction EPSS 0.00195 Published 2025-04-19 No fix listed CWE-754

TI-2022-23319 CVE-2022-47111 · GHSA-f2q2-pv27-hgjf

Improper check for unusual conditions in 7-Zip

MEDIUM 49

7-Zip 22.01 does not report an error for certain invalid xz files, involving block flags and reserved bits.

CVSS 3.1LOW 3.3 Local No auth User interaction EPSS 0.00241 Published 2025-04-19 No fix listed CWE-754

TI-2025-00330 CVE-2025-0411 · GHSA-2pjx-wvcg-vhr8

Protection mechanism failure in 7-Zip

CRITICAL 90KEV

7-Zip Mark-of-the-Web Bypass Vulnerability.

CVSS 3.1HIGH 7.0 Local No auth User interaction EPSS 0.47574 Published 2025-01-25 No fix listed CWE-693

TI-2024-10630 CVE-2024-11477 · GHSA-882h-ff2x-f86q

Integer underflow in 7-Zip

HIGH 69

7-Zip Zstandard Decompression Integer Underflow Remote Code Execution Vulnerability.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.2239 Published 2024-11-22 No fix listed CWE-191

TI-2024-10759 CVE-2024-11612 · GHSA-jrq3-7p6q-9m8h

Infinite loop in 7-Zip

LOW 33

7-Zip CopyCoder Infinite Loop Denial-of-Service Vulnerability.

CVSS 3.0MEDIUM 6.5 Network No auth User interaction EPSS 0.01881 Published 2024-11-22 No fix listed CWE-835

TI-2023-21297 CVE-2023-40481 · GHSA-cxpp-vp7p-m7fw

Out-of-bounds write in 7-Zip

MEDIUM 51

7-Zip SquashFS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.

CVSS 3.0HIGH 7.8 Local No auth User interaction EPSS 0.13836 Published 2024-05-03 No fix listed CWE-787

TI-2023-14827 CVE-2023-31102 · GHSA-4cc6-f2xj-w7jx

Ppmd7.c in 7-Zip before 23.00 allows an integer underflow and invalid read operation via a crafted 7Z archive.

HIGH 69

Ppmd7.c in 7-Zip before 23.00 allows an integer underflow and invalid read operation via a crafted 7Z archive.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.53987 Published 2023-11-03 No fix listed CWE-191

TI-2022-11631 CVE-2022-29072 · GHSA-37mw-x654-r2j8

7-Zip through 21.07 on Windows allows privilege escalation and command execution when a…

LOW 37

7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is dragged to the Help>Contents area.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.01536 Published 2022-04-15 No fix listed CWE-787

TI-2018-07177 CVE-2018-10115 · GHSA-75r2-jhx8-x356

Incorrect initialization logic of RAR decoder objects in 7-Zip 18.03 and before can lead…

MEDIUM 41

Incorrect initialization logic of RAR decoder objects in 7-Zip 18.03 and before can lead to usage of uninitialized memory, allowing remote attackers to cause a denial of service (segmentation fault) or execute arbitrary…

CVSS 3.0HIGH 7.8 Local No auth User interaction EPSS 0.04332 Published 2018-05-02 No fix listed CWE-665

TI-2018-07209 CVE-2018-10172 · GHSA-rpcp-46mr-7cgp

7-Zip through 18.01 on Windows implements the "Large memory pages" option by calling the…

LOW 38

7-Zip through 18.01 on Windows implements the "Large memory pages" option by calling the LsaAddAccountRights function to add the SeLockMemoryPrivilege privilege to the user's account, which makes it easier for attackers…

CVSS 3.0HIGH 8.8 Local Low privileges No interaction EPSS 0.00369 Published 2018-04-16 No fix listed CWE-269

Vulnerabilities

Filters