CVE-2025-44089 in ExpressZip
Summary
by MITRE • 07/23/2026
An issue in NCH Software ExpressZip v11.29 allows attackers to execute arbitrary code via downloading and executing a crafted archive file.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/23/2026
The vulnerability in NCH Software ExpressZip v11.29 represents a critical remote code execution flaw that arises from insufficient input validation during archive file processing. This issue stems from the software's failure to properly sanitize user-supplied archive data, creating an avenue for malicious actors to craft specially designed archive files that trigger unintended code execution when processed by the vulnerable application. The flaw operates at the core of the decompression and extraction functionality, where attacker-controlled data can influence the program flow through improper handling of archive metadata or file paths.
From a technical perspective this vulnerability manifests as a buffer overflow or injection condition within the archive parsing routines, allowing attackers to manipulate memory structures or execution paths when the software attempts to extract or process maliciously crafted archive contents. The vulnerability aligns with CWE-121 Stack-based Buffer Overflow and CWE-78 Improper Neutralization of Special Elements used in an OS Command, depending on the specific implementation details. Attackers can exploit this weakness by creating archive files containing specially crafted file names, directory structures, or compressed data that when processed by ExpressZip v11.29 will result in arbitrary code execution with the privileges of the affected user.
The operational impact of this vulnerability extends beyond simple privilege escalation concerns as it enables attackers to establish persistent access, exfiltrate sensitive data, or deploy additional malware payloads within systems where the vulnerable software is installed. This represents a significant threat vector for both enterprise and individual users, particularly in environments where archive files are commonly downloaded from untrusted sources or processed automatically by automated systems. The vulnerability affects all versions of ExpressZip v11.29 and potentially earlier versions that share similar code patterns, making it a widespread concern across numerous installations.
Security professionals should consider this vulnerability in relation to ATT&CK technique T1059 Command and Scripting Interpreter and T1203 Exploitation for Client Execution, as the attack chain involves leveraging legitimate software functionality to execute malicious payloads. Organizations should implement immediate mitigations including disabling automatic archive extraction, restricting user privileges when processing untrusted archives, and deploying network-based protections such as web application firewalls or content filtering solutions. The recommended remediation involves applying the vendor's official patch or upgrade to a non-vulnerable version, while also implementing principle of least privilege controls for archive processing operations. Additionally, regular security awareness training should emphasize the dangers of downloading and executing untrusted archive files from unknown sources to reduce the attack surface and prevent successful exploitation attempts.