Every CVE Search/ Get API key

CVE-2022-47112

7-Zip through 24.09 does not report an error for certain invalid xz files, involving stream flags...

2.5 LowFix available

7-Zip 22.01 does not report an error for certain invalid xz files, involving stream flags and reserved bits. Some later versions are unaffected.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.19%Up 0.2 points since Apr 20, 2025
90%50%10%1%

What each source reports

CVE List Score used 2.5

7-Zip 22.01 does not report an error for certain invalid xz files, involving stream flags and reserved bits. Some later versions are unaffected.

Record
CVE-2022-47112
CVSS 3.1
2.5 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Weakness
CWE-754
Updated
2026-11-02
EUVDEUVD-2022-49887 2.5

7-Zip 22.01 does not report an error for certain invalid xz files, involving stream flags and reserved bits. Some later versions are unaffected.

Record
EUVD-2022-49887
CVSS 3.1
2.5 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-8j5h-cxpp-7g62 2.5

7-Zip through 24.09 does not report an error for certain invalid xz files, involving stream flags...

7-Zip through 24.09 does not report an error for certain invalid xz files, involving stream flags and reserved bits.

Record
GHSA-8j5h-cxpp-7g62
CVSS 3.1
2.5 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Weakness
CWE-754
Updated
2026-11-02
NVD 2.5

7-Zip 22.01 does not report an error for certain invalid xz files, involving stream flags and reserved bits. Some later versions are unaffected.

Record
CVE-2022-47112
CVSS 3.1
2.5 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weakness
CWE-754
Updated
2026-11-02
OSV 3.3

7-Zip 22.01 does not report an error for certain invalid xz files, involving stream flags and reserved bits. Some later versions are unaffected.

Record
CVE-2022-47112
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2022-47112 2.5

7-Zip 22.01 does not report an error for certain invalid xz files, involving stream flags and reserved bits. Some later versions are unaffected.

Record
UBUNTU-CVE-2022-47112
CVSS 3.1
2.5 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2022-47112 No score

7-Zip 22.01 does not report an error for certain invalid xz files, involving stream flags and reserved bits. Some later versions are unaffected.

Record
DEBIAN-CVE-2022-47112
Updated
2026-11-03

Affected products

Affected packages

Affected packages
PackageAffectedFixed
7zip
Debian:12
 All versions, plus listed versions
22.01+dfsg-10~exp122.01+dfsg-822.01+dfsg-8+deb12u122.01+dfsg-922.01+really25.01+dfsg-0+deb12u1
Show 45 moreShow less
22.01+really26.01+dfsg-0+deb12u122.01+really26.02+dfsg-0+deb12u123.01+dfsg-123.01+dfsg-1023.01+dfsg-1123.01+dfsg-1223.01+dfsg-223.01+dfsg-323.01+dfsg-423.01+dfsg-4~exp123.01+dfsg-523.01+dfsg-623.01+dfsg-723.01+dfsg-823.01+dfsg-924.05+dfsg-124.05+dfsg-224.05+dfsg-324.06+dfsg-124.06+dfsg-224.06+dfsg-324.06+dfsg-424.07+dfsg-124.07+dfsg-224.08+dfsg-124.08+dfsg-1~bpo12+124.08+dfsg-224.09+dfsg-124.09+dfsg-224.09+dfsg-2~bpo12+124.09+dfsg-324.09+dfsg-424.09+dfsg-524.09+dfsg-624.09+dfsg-724.09+dfsg-7~bpo12+124.09+dfsg-824.09+dfsg-8~bpo12+125.00+dfsg-125.01+dfsg-125.01+dfsg-1~deb13u125.01+dfsg-1~deb13u1~bpo12+125.01+dfsg-1~deb13u225.01+dfsg-225.01+dfsg-3
 None known
7zip
Debian:13
 All versions, plus listed versions
24.09+dfsg-825.00+dfsg-125.01+dfsg-125.01+dfsg-1~deb13u125.01+dfsg-1~deb13u1~bpo12+1
Show 24 moreShow less
25.01+dfsg-1~deb13u225.01+dfsg-225.01+dfsg-325.01+dfsg-425.01+dfsg-526.00+dfsg-126.00+dfsg-226.00+dfsg-326.00+dfsg-426.00+dfsg-526.00+dfsg1-126.00+dfsg1-226.00+dfsg1-326.01+dfsg-126.01+dfsg-226.01+dfsg-326.02+dfsg-126.02+dfsg-226.02+dfsg-326.03+dfsg-126.03+dfsg-226.03+dfsg-326.04+dfsg-126.05+dfsg-1
 None known
7zip
Debian:14
 All versions, plus listed versions
24.09+dfsg-825.00+dfsg-125.01+dfsg-125.01+dfsg-1~deb13u125.01+dfsg-1~deb13u1~bpo12+1
Show 24 moreShow less
25.01+dfsg-1~deb13u225.01+dfsg-225.01+dfsg-325.01+dfsg-425.01+dfsg-526.00+dfsg-126.00+dfsg-226.00+dfsg-326.00+dfsg-426.00+dfsg-526.00+dfsg1-126.00+dfsg1-226.00+dfsg1-326.01+dfsg-126.01+dfsg-226.01+dfsg-326.02+dfsg-126.02+dfsg-226.02+dfsg-326.03+dfsg-126.03+dfsg-226.03+dfsg-326.04+dfsg-126.05+dfsg-1
 None known
p7zip
Debian:12
 All versions, plus listed versions
16.02+dfsg-816.02+really25.01+dfsg-0+deb12u116.02+really26.01+dfsg-0+deb12u116.02+really26.02+dfsg-0+deb12u116.02+transitional.1
 None known
p7zip
Debian:13
 before 16.02+transitional.1
16.02+transitional.1
p7zip
Ubuntu:14.04:LTS
 All versions, plus listed versions
9.20.1~dfsg.1-49.20.1~dfsg.1-4+deb7u1build0.14.04.19.20.1~dfsg.1-4+deb7u2build0.14.04.19.20.1~dfsg.1-4+deb7u3build0.14.04.1
 None known
p7zip
Ubuntu:16.04:LTS
 All versions, plus listed versions
9.20.1~dfsg.1-4.29.20.1~dfsg.1-4.2ubuntu0.1
 None known
p7zip
Ubuntu:18.04:LTS
 All versions, plus listed versions
16.02+dfsg-416.02+dfsg-516.02+dfsg-6
 None known
p7zip
Ubuntu:20.04:LTS
 All versions, plus listed versions
16.02+dfsg-716.02+dfsg-7build1
 None known
p7zip
Ubuntu:22.04:LTS
 All versions, plus listed versions
16.02+dfsg-8
 None known
Show 5 moreShow less
Affected packages
PackageAffectedFixed
7zip
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
21.03~beta+dfsg-621.04~beta+dfsg-121.06+dfsg-121.07+dfsg-121.07+dfsg-221.07+dfsg-321.07+dfsg-421.07+dfsg-4ubuntu0.1~esm1
 None known
7zip
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
23.01+dfsg-323.01+dfsg-723.01+dfsg-823.01+dfsg-1123.01+dfsg-11ubuntu0.1~esm1
 None known
7zip
Ubuntu:25.10
 All versions, plus listed versions
24.09+dfsg-724.09+dfsg-825.00+dfsg-125.01+dfsg-125.01+dfsg-2
 None known
7zip
Ubuntu:26.10
 All versions, plus listed versions
26.00+dfsg-126.01+dfsg-226.01+dfsg-326.02+dfsg-126.02+dfsg-2
 None known
7zip
Ubuntu:26.04:LTS
 All versions, plus listed versions
25.01+dfsg-225.01+dfsg-325.01+dfsg-425.01+dfsg-526.00+dfsg-1
 None known

History

History
RecordedChangedSources
affectedOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-47112 is a low vulnerability (CVSS 2.5) in 7-zip, published April 19, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 9th percentile. Fixed in p7zip 16.02+transitional.1.

References

This page doesn't list everything

Left out here: 21 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open