Every CVE Search/ Get API key

CVE-2024-11477

7-Zip Zstandard Decompression Integer Underflow Remote Code Execution Vulnerability

7.8 HighPublic exploitFix available

7-Zip Zstandard Decompression Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the implementation of Zstandard decompression. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24346.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

22.4%Up 22.3 points since Nov 23, 2024
90%50%10%1%

What each source reports

CVE List Score used 7.8

7-Zip Zstandard Decompression Integer Underflow Remote Code Execution Vulnerability

7-Zip Zstandard Decompression Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the implementation of Zstandard decompression. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24346.

Record
CVE-2024-11477
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-191
Updated
2026-11-02
EUVDEUVD-2024-34129 7.8

7-Zip Zstandard Decompression Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the implementation of Zstandard decompression. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24346.

Record
EUVD-2024-34129
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-882h-ff2x-f86q 7.8

7-Zip Zstandard Decompression Integer Underflow Remote Code Execution Vulnerability. This...

7-Zip Zstandard Decompression Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the implementation of Zstandard decompression. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24346.

Record
GHSA-882h-ff2x-f86q
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-191
Updated
2026-11-02
NVD 7.8

7-Zip Zstandard Decompression Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the implementation of Zstandard decompression. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24346.

Record
CVE-2024-11477
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-191
Updated
2026-11-02
OSVALPINE-CVE-2024-11477 7.8

7-Zip Zstandard Decompression Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the implementation of Zstandard decompression. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24346.

Record
ALPINE-CVE-2024-11477
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSV 7.8

7-Zip Zstandard Decompression Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the implementation of Zstandard decompression. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24346.

Record
CVE-2024-11477
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2024-11477 7.8

7-Zip Zstandard Decompression Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the implementation of Zstandard decompression. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24346.

Record
DEBIAN-CVE-2024-11477
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2024-11477 7.8

7-Zip Zstandard Decompression Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the implementation of Zstandard decompression. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24346.

Record
UBUNTU-CVE-2024-11477
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2025:15531-1 No score

libQt5Pdf5-5.15.19-1.1 on GA media

These are all security issues fixed in the libQt5Pdf5-5.15.19-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15531-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
qt5-qtwebengine
Alpine:v3.21
 before 5.15.17-r7
5.15.17-r7
qt5-qtwebengine
Alpine:v3.22
 before 5.15.17-r10
5.15.17-r10
qt5-qtwebengine
Alpine:v3.23
 before 5.15.17-r10
5.15.17-r10
qt6-qtwebengine
Alpine:v3.22
 before 6.8.2-r3
6.8.2-r3
qt6-qtwebengine
Alpine:v3.23
 before 6.8.2-r3
6.8.2-r3
qt6-qtwebengine
Alpine:v3.24
 before 6.8.2-r3
6.8.2-r3
7zip
Debian:13
 before 24.07+dfsg-1
24.07+dfsg-1
7zip
Debian:14
 before 24.07+dfsg-1
24.07+dfsg-1
p7zip
Ubuntu:14.04:LTS
 All versions, plus listed versions
9.20.1~dfsg.1-49.20.1~dfsg.1-4+deb7u1build0.14.04.19.20.1~dfsg.1-4+deb7u2build0.14.04.19.20.1~dfsg.1-4+deb7u3build0.14.04.1
 None known
p7zip
Ubuntu:16.04:LTS
 All versions, plus listed versions
9.20.1~dfsg.1-4.29.20.1~dfsg.1-4.2ubuntu0.1
 None known
Show 4 moreShow less
Affected packages
PackageAffectedFixed
p7zip
Ubuntu:18.04:LTS
 All versions, plus listed versions
16.02+dfsg-416.02+dfsg-516.02+dfsg-6
 None known
p7zip
Ubuntu:20.04:LTS
 All versions, plus listed versions
16.02+dfsg-716.02+dfsg-7build1
 None known
p7zip
Ubuntu:22.04:LTS
 All versions, plus listed versions
16.02+dfsg-8
 None known
libqt5-qtwebengine
openSUSE:Tumbleweed
From an advisory covering 16 CVEs
 before 5.15.19-1.1
5.15.19-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubTheN00bBuilder/cve-2024-11477-writeup2024-11-29

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-11477 is a high vulnerability (CVSS 7.8) in 7-zip, published November 22, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 22.4%, the 97th percentile. Fixed in qt5-qtwebengine 5.15.17-r7.

References

Show 18 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open