CVE-2022-47111

7-Zip through 24.09 does not report an error for certain invalid xz files, involving block flags...

2.5 LowFix available

7-Zip 22.01 does not report an error for certain invalid xz files, involving block flags and reserved bits. Some later versions are unaffected.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: High
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: None

Exploit likelihood

0.24%Up 0.2 points since Apr 20, 2025

What each source reports

CVE List Score used 2.5

7-Zip 22.01 does not report an error for certain invalid xz files, involving block flags and reserved bits. Some later versions are unaffected.

Record: CVE-2022-47111
CVSS 3.1: 2.5 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Weakness: CWE-754
Updated: 2026-11-02

EUVDEUVD-2022-49886 2.5

7-Zip 22.01 does not report an error for certain invalid xz files, involving block flags and reserved bits. Some later versions are unaffected.

Record: EUVD-2022-49886
CVSS 3.1: 2.5 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-f2q2-pv27-hgjf 2.5

7-Zip through 24.09 does not report an error for certain invalid xz files, involving block flags...

7-Zip through 24.09 does not report an error for certain invalid xz files, involving block flags and reserved bits.

Record: GHSA-f2q2-pv27-hgjf
CVSS 3.1: 2.5 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Weakness: CWE-754
Updated: 2026-11-02

NVD 2.5

7-Zip 22.01 does not report an error for certain invalid xz files, involving block flags and reserved bits. Some later versions are unaffected.

Record: CVE-2022-47111
CVSS 3.1: 2.5 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS 3.1: 3.3 LowCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weakness: CWE-754
Updated: 2026-11-02

OSV 3.3

7-Zip 22.01 does not report an error for certain invalid xz files, involving block flags and reserved bits. Some later versions are unaffected.

Record: CVE-2022-47111
CVSS 3.1: 3.3 LowCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2022-47111 3.3

7-Zip 22.01 does not report an error for certain invalid xz files, involving block flags and reserved bits. Some later versions are unaffected.

Record: DEBIAN-CVE-2022-47111
CVSS 3.1: 3.3 LowCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Updated: 2026-11-03

OSVUBUNTU-CVE-2022-47111 2.5

7-Zip 22.01 does not report an error for certain invalid xz files, involving block flags and reserved bits. Some later versions are unaffected.

Record: UBUNTU-CVE-2022-47111
CVSS 3.1: 2.5 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS 3.1: 3.3 LowCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Updated: 2026-11-02

Affected products

7-zip

Affected packages

Affected packages
Package	Affected	Fixed
`7zip` Debian:12	All versions, plus listed versions 22.01+dfsg-10~exp122.01+dfsg-822.01+dfsg-8+deb12u122.01+dfsg-922.01+really25.01+dfsg-0+deb12u1 Show 45 moreShow less 22.01+really26.01+dfsg-0+deb12u122.01+really26.02+dfsg-0+deb12u123.01+dfsg-123.01+dfsg-1023.01+dfsg-1123.01+dfsg-1223.01+dfsg-223.01+dfsg-323.01+dfsg-423.01+dfsg-4~exp123.01+dfsg-523.01+dfsg-623.01+dfsg-723.01+dfsg-823.01+dfsg-924.05+dfsg-124.05+dfsg-224.05+dfsg-324.06+dfsg-124.06+dfsg-224.06+dfsg-324.06+dfsg-424.07+dfsg-124.07+dfsg-224.08+dfsg-124.08+dfsg-1~bpo12+124.08+dfsg-224.09+dfsg-124.09+dfsg-224.09+dfsg-2~bpo12+124.09+dfsg-324.09+dfsg-424.09+dfsg-524.09+dfsg-624.09+dfsg-724.09+dfsg-7~bpo12+124.09+dfsg-824.09+dfsg-8~bpo12+125.00+dfsg-125.01+dfsg-125.01+dfsg-1~deb13u125.01+dfsg-1~deb13u1~bpo12+125.01+dfsg-1~deb13u225.01+dfsg-225.01+dfsg-3	None known
`7zip` Debian:13	All versions, plus listed versions 24.09+dfsg-825.00+dfsg-125.01+dfsg-125.01+dfsg-1~deb13u125.01+dfsg-1~deb13u1~bpo12+1 Show 24 moreShow less 25.01+dfsg-1~deb13u225.01+dfsg-225.01+dfsg-325.01+dfsg-425.01+dfsg-526.00+dfsg-126.00+dfsg-226.00+dfsg-326.00+dfsg-426.00+dfsg-526.00+dfsg1-126.00+dfsg1-226.00+dfsg1-326.01+dfsg-126.01+dfsg-226.01+dfsg-326.02+dfsg-126.02+dfsg-226.02+dfsg-326.03+dfsg-126.03+dfsg-226.03+dfsg-326.04+dfsg-126.05+dfsg-1	None known
`7zip` Debian:14	All versions, plus listed versions 24.09+dfsg-825.00+dfsg-125.01+dfsg-125.01+dfsg-1~deb13u125.01+dfsg-1~deb13u1~bpo12+1 Show 24 moreShow less 25.01+dfsg-1~deb13u225.01+dfsg-225.01+dfsg-325.01+dfsg-425.01+dfsg-526.00+dfsg-126.00+dfsg-226.00+dfsg-326.00+dfsg-426.00+dfsg-526.00+dfsg1-126.00+dfsg1-226.00+dfsg1-326.01+dfsg-126.01+dfsg-226.01+dfsg-326.02+dfsg-126.02+dfsg-226.02+dfsg-326.03+dfsg-126.03+dfsg-226.03+dfsg-326.04+dfsg-126.05+dfsg-1	None known
`p7zip` Debian:12	All versions, plus listed versions 16.02+dfsg-816.02+really25.01+dfsg-0+deb12u116.02+really26.01+dfsg-0+deb12u116.02+really26.02+dfsg-0+deb12u116.02+transitional.1	None known
`p7zip` Debian:13	before 16.02+transitional.1	16.02+transitional.1
`p7zip` Ubuntu:14.04:LTS	All versions, plus listed versions 9.20.1~dfsg.1-49.20.1~dfsg.1-4+deb7u1build0.14.04.19.20.1~dfsg.1-4+deb7u2build0.14.04.19.20.1~dfsg.1-4+deb7u3build0.14.04.1	None known
`p7zip` Ubuntu:16.04:LTS	All versions, plus listed versions 9.20.1~dfsg.1-4.29.20.1~dfsg.1-4.2ubuntu0.1	None known
`p7zip` Ubuntu:18.04:LTS	All versions, plus listed versions 16.02+dfsg-416.02+dfsg-516.02+dfsg-6	None known
`p7zip` Ubuntu:20.04:LTS	All versions, plus listed versions 16.02+dfsg-716.02+dfsg-7build1	None known
`p7zip` Ubuntu:22.04:LTS	All versions, plus listed versions 16.02+dfsg-8	None known

Show 5 moreShow less

Affected packages
Package	Affected	Fixed
`7zip` Ubuntu:Pro:22.04:LTS	All versions, plus listed versions 21.03~beta+dfsg-621.04~beta+dfsg-121.06+dfsg-121.07+dfsg-121.07+dfsg-221.07+dfsg-321.07+dfsg-421.07+dfsg-4ubuntu0.1~esm1	None known
`7zip` Ubuntu:Pro:24.04:LTS	All versions, plus listed versions 23.01+dfsg-323.01+dfsg-723.01+dfsg-823.01+dfsg-1123.01+dfsg-11ubuntu0.1~esm1	None known
`7zip` Ubuntu:25.10	All versions, plus listed versions 24.09+dfsg-724.09+dfsg-825.00+dfsg-125.01+dfsg-125.01+dfsg-2	None known
`7zip` Ubuntu:26.10	All versions, plus listed versions 26.00+dfsg-126.01+dfsg-226.01+dfsg-326.02+dfsg-126.02+dfsg-2	None known
`7zip` Ubuntu:26.04:LTS	All versions, plus listed versions 25.01+dfsg-225.01+dfsg-325.01+dfsg-425.01+dfsg-526.00+dfsg-1	None known

History

History
Recorded	Changed	Sources
Nov 3, 2026	affected	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-47111 is a low vulnerability (CVSS 2.5) in 7-zip, published April 19, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 15th percentile. Fixed in p7zip 16.02+transitional.1.

References

This page doesn't list everything

Left out here: 21 versions. The JSON record has them.