7-zip up to 24.07 Mark-of-the-Web protection mechanism

Summaryinfo

A vulnerability was found in 7-zip. It has been classified as problematic. Impacted is an unknown function of the component Mark-of-the-Web. Performing a manipulation results in protection mechanism. This vulnerability is known as CVE-2025-0411. Attacking locally is a requirement. Furthermore, an exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in 7-zip. It has been classified as problematic. This affects an unknown code block of the component Mark-of-the-Web. The manipulation with an unknown input leads to a protection mechanism vulnerability. CWE is classifying the issue as CWE-693. The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of archived files. When extracting files from a crafted archive that bears the Mark-of-the-Web, 7-Zip does not propagate the Mark-of-the-Web to the extracted files. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user. Was ZDI-CAN-25456.

The advisory is shared at zerodayinitiative.com. This vulnerability is uniquely identified as CVE-2025-0411 since 01/13/2025. The exploitability is told to be difficult. An attack has to be approached locally. Technical details are unknown but an exploit is available.

It is declared as attacked. The CISA Known Exploited Vulnerabilities Catalog lists this issue since 02/06/2025 with a due date of 02/27/2025:

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Upgrading to version 24.09 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Zero-Day.cz (956). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• File Compression Software

Name

• 7-zip

Version

• 3.13
• 4.20
• 4.23
• 4.24
• 4.25
• 4.26
• 4.26 Beta
• 4.27
• 4.28
• 4.29
• 4.30
• 4.31
• 4.32
• 4.33
• 4.34
• 4.35
• 4.36
• 4.37
• 4.38
• 4.39
• 4.40
• 4.41
• 4.42
• 4.43
• 4.44
• 4.45
• 4.46
• 4.47
• 4.48
• 4.49
• 4.50
• 4.51
• 4.52
• 4.53
• 4.54
• 4.55
• 4.56
• 15.14
• 16.00
• 18.03
• 23.01
• 24.01
• 24.07

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion