Vulnerabilities

TI-2026-79288 CVE-2026-111497 · GHSA-9v8h-qqgm-4m35

Out-of-bounds write in Google Brotli decoder

CRITICAL 99KEV

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, dis…

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.82641 Published 2026-10-22 Partial fix · 1.0.10, 1.1.1 +2 CWE-252

TI-2026-74073 CVE-2026-104086 · GHSA-xhq8-p89q-r47c

Uninitialized memory disclosure in 7-Zip SquashFS archive handler

LOW 29

7-Zip before 26.03 contains an uninitialized memory disclosure vulnerability in the SquashFS v4 archive handler (SquashfsHandler.cpp) that allows attackers to leak heap memory by crafting a malicious archive where the su…

CVSS 4.0MEDIUM 6.8 Local No auth User interaction EPSS 0.00186 Published 2026-10-14 Fixed in 26.03 CWE-908

TI-2026-12078 CVE-2026-14266 · GHSA-836v-xv29-x32v

Heap-based buffer overflow in 7-Zip

LOW 37

7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00742 Published 2026-07-29 No fix listed CWE-122

TI-2026-41807 CVE-2026-58052 · GHSA-fx33-p83c-vpr5

7-Zip - Mark-of-the-Web Bypass via RAR5 Alternate Data Stream Name Collision

MEDIUM 55

7-Zip for Windows through 26.01 fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive, because its guard that suppresses an archive-supplied Zone.Identifier stream matches the exact name 'Zone.Iden…

CVSS 4.0MEDIUM 4.8 Local No auth User interaction EPSS 0.00171 Published 2026-06-28 No fix listed CWE-693

TI-2026-35552 CVE-2026-48112

GHSL-2026-122 7-Zip Ar SYMDEF OOB Read

LOW 28

7-Zip is a file archiver with a high compression ratio.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00267 Published 2026-06-05 Fixed in 26.01 CWE-125

TI-2026-35551 CVE-2026-48111

GHSL-2026-121 7-Zip UEFI DEPEX OOB Read

MEDIUM 64

7-Zip is a file archiver with a high compression ratio.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.02161 Published 2026-06-05 Fixed in 26.01 CWE-125

TI-2026-35544 CVE-2026-48104

GHSL-2026-120: 7-Zip SquashFS BlockToNode uninitialized heap read

MEDIUM 53

7-Zip is a file archiver with a high compression ratio.

CVSS 3.1MEDIUM 4.2 Network No auth User interaction EPSS 0.00179 Published 2026-06-05 Fixed in 26.01 CWE-125

TI-2026-35543 CVE-2026-48103

GHSL-2026-119 7-Zip WIM SecurityId OOB read

MEDIUM 64

7-Zip is a file archiver with a high compression ratio.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.02161 Published 2026-06-05 Fixed in 26.01 CWE-125

TI-2026-35542 CVE-2026-48102

GHSL-2026-118: 7-Zip UDF Field OOB Read

MEDIUM 53

7-Zip is a file archiver with a high compression ratio.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00189 Published 2026-06-05 Fixed in 26.01 CWE-125

TI-2026-35541 CVE-2026-48101

GHSL-2026-117: 7-Zip UEFI Capsule uninitialized heap memory disclosure

LOW 29

7-Zip is a file archiver with a high compression ratio.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00277 Published 2026-06-05 Fixed in 26.01 CWE-908

TI-2026-35535 CVE-2026-48095

GHSL-2026-140_7-Zip: 7-Zip has a heap buffer overflow via NTFS compressed stream buffer under-allocation

HIGH 73

7-Zip is a file archiver with a high compression ratio.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01116 Published 2026-06-05 No fix listed CWE-190

TI-2026-35532 CVE-2026-48092

7-Zip SquashFS Fragment Offset Overflow (GHSL-2026-116)

HIGH 68

7-Zip is a file archiver with a high compression ratio.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.02742 Published 2026-06-05 Fixed in 26.01 CWE-125

TI-2025-10073 CVE-2025-11002 · GHSA-6hqx-f664-v9xx

Path traversal in 7-Zip

LOW 37

7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00533 Published 2026-01-23 No fix listed CWE-22

TI-2025-10072 CVE-2025-11001 · GHSA-h6cw-8q9x-9gj9

Path traversal in 7-Zip

MEDIUM 58

7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.27387 Published 2025-11-19 No fix listed CWE-22

TI-2025-34865 CVE-2025-55188 · GHSA-58pw-r2v4-pwjv

7-Zip before 25.01 does not always properly handle symbolic links during extraction.

LOW 19

7-Zip before 25.01 does not always properly handle symbolic links during extraction.

CVSS 3.1LOW 3.6 Local No auth User interaction EPSS 0.00999 Published 2025-08-08 Fixed in 25.01 CWE-59

TI-2025-33709 CVE-2025-53817

GHSL-2025-059 - 7-Zip - Null pointer array write attempt in NArchive::NCom::CHandler::GetStream

LOW 26

7-Zip is a file archiver with a high compression ratio.

CVSS 4.0MEDIUM 5.5 Local No auth No interaction EPSS 0.00709 Published 2025-07-17 Fixed in 25.0.0 CWE-476

TI-2025-33708 CVE-2025-53816

GHSL-2025-058 - 7-Zip Multi-byte write heap buffer overflow in NCompress::NRar5::CDecoder

LOW 26

7-Zip is a file archiver with a high compression ratio.

CVSS 4.0MEDIUM 5.5 Local No auth No interaction EPSS 0.00733 Published 2025-07-17 Fixed in 25.0.0 CWE-122

TI-2022-23320 CVE-2022-47112 · GHSA-8j5h-cxpp-7g62

Improper check for unusual conditions in 7-Zip

MEDIUM 49

7-Zip 22.01 does not report an error for certain invalid xz files, involving stream flags and reserved bits.

CVSS 3.1LOW 3.3 Local No auth User interaction EPSS 0.00195 Published 2025-04-19 No fix listed CWE-754

TI-2022-23319 CVE-2022-47111 · GHSA-f2q2-pv27-hgjf

Improper check for unusual conditions in 7-Zip

MEDIUM 49

7-Zip 22.01 does not report an error for certain invalid xz files, involving block flags and reserved bits.

CVSS 3.1LOW 3.3 Local No auth User interaction EPSS 0.00241 Published 2025-04-19 No fix listed CWE-754

TI-2025-00330 CVE-2025-0411 · GHSA-2pjx-wvcg-vhr8

Protection mechanism failure in 7-Zip

CRITICAL 90KEV

7-Zip Mark-of-the-Web Bypass Vulnerability.

CVSS 3.1HIGH 7.0 Local No auth User interaction EPSS 0.47574 Published 2025-01-25 No fix listed CWE-693

TI-2024-10630 CVE-2024-11477 · GHSA-882h-ff2x-f86q

Integer underflow in 7-Zip

HIGH 69

7-Zip Zstandard Decompression Integer Underflow Remote Code Execution Vulnerability.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.2239 Published 2024-11-22 No fix listed CWE-191

TI-2024-10759 CVE-2024-11612 · GHSA-jrq3-7p6q-9m8h

Infinite loop in 7-Zip

LOW 33

7-Zip CopyCoder Infinite Loop Denial-of-Service Vulnerability.

CVSS 3.0MEDIUM 6.5 Network No auth User interaction EPSS 0.01881 Published 2024-11-22 No fix listed CWE-835

TI-2023-21297 CVE-2023-40481 · GHSA-cxpp-vp7p-m7fw

Out-of-bounds write in 7-Zip

MEDIUM 51

7-Zip SquashFS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.

CVSS 3.0HIGH 7.8 Local No auth User interaction EPSS 0.13836 Published 2024-05-03 No fix listed CWE-787

TI-2023-14827 CVE-2023-31102 · GHSA-4cc6-f2xj-w7jx

Ppmd7.c in 7-Zip before 23.00 allows an integer underflow and invalid read operation via a crafted 7Z archive.

HIGH 69

Ppmd7.c in 7-Zip before 23.00 allows an integer underflow and invalid read operation via a crafted 7Z archive.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.53987 Published 2023-11-03 No fix listed CWE-191

TI-2022-23297 CVE-2022-47069 · GHSA-hjgv-c5xv-9h9v

p7zip 16.02 was discovered to contain a heap-buffer-overflow vulnerability via the…

HIGH 69

p7zip 16.02 was discovered to contain a heap-buffer-overflow vulnerability via the function NArchive::NZip::CInArchive::FindCd(bool) at CPP/7zip/Archive/Zip/ZipIn.cpp.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00321 Published 2023-08-22 No fix listed CWE-787

Vulnerabilities

Filters