Every CVE Search/ Get API key

CVE-2025-53816

GHSL-2025-058 - 7-Zip Multi-byte write heap buffer overflow in NCompress::NRar5::CDecoder

5.5 MediumFix available

7-Zip is a file archiver with a high compression ratio. Zeroes written outside heap buffer in RAR5 handler may lead to memory corruption and denial of service in versions of 7-Zip prior to 25.0.0. Version 25.0.0 contains a fix for the issue.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.73%Up 0.7 points since Jul 18, 2025
90%50%10%1%

What each source reports

CVE List Score used 5.5

GHSL-2025-058 - 7-Zip Multi-byte write heap buffer overflow in NCompress::NRar5::CDecoder

7-Zip is a file archiver with a high compression ratio. Zeroes written outside heap buffer in RAR5 handler may lead to memory corruption and denial of service in versions of 7-Zip prior to 25.0.0. Version 25.0.0 contains a fix for the issue.

Record
CVE-2025-53816
CVSS 4.0
5.5 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
Weakness
CWE-122
Updated
2026-11-02
EUVDEUVD-2025-21791 5.5

7-Zip is a file archiver with a high compression ratio. Zeroes written outside heap buffer in RAR5 handler may lead to memory corruption and denial of service in versions of 7-Zip prior to 25.0.0. Version 25.0.0 contains a fix for the issue.

Record
EUVD-2025-21791
CVSS 4.0
5.5 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
Updated
2026-11-02
NVD 5.5

7-Zip is a file archiver with a high compression ratio. Zeroes written outside heap buffer in RAR5 handler may lead to memory corruption and denial of service in versions of 7-Zip prior to 25.0.0. Version 25.0.0 contains a fix for the issue.

Record
CVE-2025-53816
CVSS 4.0
5.5 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-122
Updated
2026-11-02
OSV 5.5

GHSL-2025-058 - 7-Zip Multi-byte write heap buffer overflow in NCompress::NRar5::CDecoder

7-Zip is a file archiver with a high compression ratio. Zeroes written outside heap buffer in RAR5 handler may lead to memory corruption and denial of service in versions of 7-Zip prior to 25.0.0. Version 25.0.0 contains a fix for the issue.

Record
CVE-2025-53816
CVSS 4.0
5.5 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
Weakness
CWE-122
Updated
2026-11-02
OSVDEBIAN-CVE-2025-53816 7.5

7-Zip is a file archiver with a high compression ratio. Zeroes written outside heap buffer in RAR5 handler may lead to memory corruption and denial of service in versions of 7-Zip prior to 25.0.0. Version 25.0.0 contains a fix for the issue.

Record
DEBIAN-CVE-2025-53816
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2025-53816 5.5

7-Zip is a file archiver with a high compression ratio. Zeroes written outside heap buffer in RAR5 handler may lead to memory corruption and denial of service in versions of 7-Zip prior to 25.0.0. Version 25.0.0 contains a fix for the issue.

Record
UBUNTU-CVE-2025-53816
CVSS 4.0
5.5 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2025:15523-1 No score

7zip-25.01-1.1 on GA media

These are all security issues fixed in the 7zip-25.01-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15523-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20273-1 No score

Security update for 7zip

This update for 7zip fixes the following issues:

  • Update to 25.01 (boo#1249130)

    • The code for handling symbolic links has been changed to provide greater security when extracting files from archives
    • Command line switch -snld20 can be used to bypass default security checks when creating symbolic links.

  • Update to 25.00:

    • bzip2 compression speed was increased by 15-40%.
    • deflate (zip/gz) compression speed was increased by 1-3%.
    • improved support for zip, cpio and fat archives.
    • CVE-2025-53816: Fixed input manipulation leading to heap buffer overflow (bsc#1246706)
    • CVE-2025-53817: Fixed null pointer dereference leading to denial of service (bsc#1246707)
Record
openSUSE-SU-2026:20273-1
Updated
2026-11-02
OSVSUSE-SU-2026:20592-1 No score

Security update for 7zip

This update for 7zip fixes the following issues:

  • Update to 25.01 (boo#1249130)

    • The code for handling symbolic links has been changed to provide greater security when extracting files from archives
    • Command line switch -snld20 can be used to bypass default security checks when creating symbolic links.

  • Update to 25.00:

    • bzip2 compression speed was increased by 15-40%.
    • deflate (zip/gz) compression speed was increased by 1-3%.
    • improved support for zip, cpio and fat archives.
    • CVE-2025-53816: Fixed input manipulation leading to heap buffer overflow (bsc#1246706)
    • CVE-2025-53817: Fixed null pointer dereference leading to denial of service (bsc#1246707)
Record
SUSE-SU-2026:20592-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
7zip-rar
Debian:13
 before 25.00+ds-1, plus listed versions
22.01-123.01-123.01-223.01-323.01-4
Show 9 moreShow less
24.05+ds-124.05+ds-224.06+ds-124.07+ds-124.08+ds-124.09+ds-124.09+ds-224.09+ds-324.09+ds-3~bpo12+1
25.00+ds-1
7zip-rar
Debian:14
 before 25.00+ds-1, plus listed versions
22.01-123.01-123.01-223.01-323.01-4
Show 9 moreShow less
24.05+ds-124.05+ds-224.06+ds-124.07+ds-124.08+ds-124.09+ds-124.09+ds-224.09+ds-324.09+ds-3~bpo12+1
25.00+ds-1
p7zip-rar
Debian:12
 before 16.02+really25.00+ds-0+deb12u1, plus listed versions
15.09-115.09-215.14.1-116.02-116.02-2
Show 17 moreShow less
16.02-34.44-14.44.ds.1-14.45~ds.1-14.47~ds.1-14.51~ds.1-14.55~ds.1-14.55~ds.1-24.57~ds.1-14.58~ds.1-14.61~ds.1-14.65~ds.1-19.04~ds.1-19.20.1~ds.1-19.20.1~ds.1-29.20.1~ds.1-39.20.1~ds.1-4
16.02+really25.00+ds-0+deb12u1
p7zip-rar
Debian:13
 before 16.02+transitional.1, plus listed versions
15.09-115.09-215.14.1-116.02-116.02-2
Show 17 moreShow less
16.02-34.44-14.44.ds.1-14.45~ds.1-14.47~ds.1-14.51~ds.1-14.55~ds.1-14.55~ds.1-24.57~ds.1-14.58~ds.1-14.61~ds.1-14.65~ds.1-19.04~ds.1-19.20.1~ds.1-19.20.1~ds.1-29.20.1~ds.1-39.20.1~ds.1-4
16.02+transitional.1
7zip
SUSE:Linux Enterprise Server 16.0
From an advisory covering 2 CVEs
 before 25.01-160000.1.1
25.01-160000.1.1
7zip
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 2 CVEs
 before 25.01-160000.1.1
25.01-160000.1.1
7zip
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
21.03~beta+dfsg-621.04~beta+dfsg-121.06+dfsg-121.07+dfsg-121.07+dfsg-221.07+dfsg-321.07+dfsg-421.07+dfsg-4ubuntu0.1~esm1
 None known
7zip
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
23.01+dfsg-323.01+dfsg-723.01+dfsg-823.01+dfsg-1123.01+dfsg-11ubuntu0.1~esm1
 None known
7zip
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 25.01-1.1
25.01-1.1
7zip
openSUSE:Leap 16.0
From an advisory covering 2 CVEs
 before 25.01-160000.1.1
25.01-160000.1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-53816 is a medium vulnerability (CVSS 5.5) in 7-zip, published July 17, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.73%, the 54th percentile. Fixed in 7zip-rar 25.00+ds-1.

References

Show 8 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open